The New Regulation introduces the requirement to appoint a Data Protection Officer ('DPO') under certain circumstances. This requirement applies to Data Controllers and Data Processors who either:

• Are public entities
• Process large volumes of Personal Data, in terms of quantity or the nature of the data processed, or
• Carry out data processing activities that involve the processing of: 
  • Pesonal Data relating to a large number of data subjects,
  • Sensitive Personal Data as part of the entity's core activity or main line of business, or
  • Personal Data whose processing may result in evident prejudice to the fundamental rights or freedoms of data subjects

Compliance with this obligation is subject to staggered grace periods, ranging from November 30, 2025 to November 30, 2028, depending on the entity’s annual revenue, as follows:

In this regard, on December 31, 2025, through Directorial Resolution No. 100-2025-JUS-DGTAIPD, the authority published the Directive establishing provisions on the designation, performance, and functions of the DPO ('Directive').

According to the Directive, the individual appointed as DPO must meet the following requirements:

• Have at least two (2) years of general professional experience in functions related to personal data protection or related fields, such as information security, cybersecurity, digital governance, artificial intelligence, or other activities related to the processing of personal data.
• Have at least one (1) year of specific experience in activities directly related to personal data protection, at a national or international level, in either the public or private sector.
• Possess duly accredited knowledge of personal data protection. Such knowledge may be evidenced through proven and continuous experience in university teaching or research in the field, completed postgraduate studies or academic degrees, or certifications and/or diplomas in personal data protection or related matters, in accordance with the criteria set out in the Directive.
• Demonstrate moral and ethical integrity, which includes not having a final criminal conviction for intentional crimes, being subject to a formal criminal investigation, or having been convicted of computer-related crimes, among other circumstances set out in the Directive.

Additionally, the DPO must:

• Act with functional independence in the performance of their duties, meaning that they may not be instructed or directed regarding the substance of their opinions, recommendations, or technical decisions.
• Be familiar with the internal regulations, directives, and guidelines governing the company’s data protection management framework.
• Have knowledge of the sector in which the company operates, as well as the regulations and obligations that directly or indirectly affect personal data processing activities.

The key responsibilities of the DPO include:

• Informing and advising on the obligations established under personal data protection regulations.
• Monitoring and reporting on compliance with applicable laws and with the policies of the data controller or data processor, including the allocation of responsibilities, awareness-raising and training of personnel involved in processing activities, and the performance of audits.
• Cooperating with the NDPA in the exercise of its functions and powers.
• Acting as the primary point of contact with the NDPA on matters related to the processing of personal data.

The DPO may be either internal or external to the company. The appointment of the DPO must be notified to the NDPA within 15 business days following the designation. Likewise, the identification and contact details of the DPO must be made available to data subjects.