Latin America
Student accommodation regulation in Peru (2026)
Peru has no rule that regulates student residences as an activity. Anyone opening or running one combines the Civil Code, which separates a lease from a lodging agreement; the Framework Law on Operating Licences and the technical safety inspection of the premises; and Law 29733 on Personal Data Protection, with the regulation in force since March 2025. Since January 2026 the regulation of the artificial intelligence law is also in force.
The short answer
Peru has no student accommodation act. It has the Civil Code hospedaje (lodging agreement), which fits a residence with services, and a data protection and artificial intelligence regime renewed between 2024 and 2026.
| What | Rule | Who applies it |
|---|---|---|
| Legal figure | No act of its own: lease or lodging agreement | Civil courts |
| Contract | Civil Code, Arts. 1666 ff. and 1713 to 1727 | Civil courts |
| Premises | Consolidated text of Law 28976, on operating licences, and technical safety inspection | District or provincial municipality |
| Data | Law 29733 and its Regulation | National Authority for Personal Data Protection |
| AI | Law 31814 and its Regulation | Presidency of the Council of Ministers (Secretariat of Digital Government and Transformation) |
What residences are called there
There are university residences, private student residences —PBSA elsewhere— and rooms or pensiones with services. None is a legal figure; the Civil Code offers two contracts:
- Arrendamiento (lease, Art. 1666): the landlord temporarily grants the tenant the use of a property for an agreed rent. It fits the student residence that only provides the room.
- Hospedaje (lodging agreement, Art. 1713): the host provides the guest with accommodation "y, adicionalmente, alimentación y otros servicios que contemplan la ley y los usos, a cambio de una retribución" ("and, in addition, meals and other services provided for by law and custom, in return for payment"). It fits the residence with a dining hall, cleaning and reception.
The contract: lease or lodging
If it is a lease, a fixed term cannot exceed ten years (Art. 1688) and the rest is agreed within the rules of the Civil Code. If it is hospedaje, the contract carries its own obligations:
- It is subject to the regulations and to the general contracting terms approved by the competent authority (Art. 1714), which the establishment displays in a visible place (Art. 1716).
- The guest can demand a clean room with services in normal working order and, if there are meals, food that meets quality and hygiene requirements (Art. 1715).
- The host is liable as a depositary for what it receives for safekeeping (Art. 1718) and for the guest's everyday items (Art. 1719).
The premises
The framework is national and municipalities apply it. Anyone providing services in an establishment needs an operating licence before opening, granted by the district or the provincial municipality (Texto Único Ordenado (consolidated text, TUO) of Law 28976, Arts. 3 to 5). On receiving the application, the municipality rates the building's risk level with the risk matrix (Art. 8): if it is low or medium, the licence is approved automatically and the technical safety inspection of buildings (ITSE) comes afterwards; if it is high or very high, the inspection comes first. The ITSE certificate lasts two years (Art. 12).
Beforehand, the municipality advises on zoning (Art. 8): what fits in a building depends on the district.
Data protection
Law 29733 applies with a new Regulation, Supreme Decree 016-2024-JUS, published in El Peruano on 30 November 2024 and in force 120 calendar days later, in late March 2025. The authority is the Ministry of Justice and Human Rights as the National Authority for Personal Data Protection (Art. 32 of the law). For a residence that answers on WhatsApp:
- Consent and information: consent is needed (Art. 5), except, among other cases, to perform the contract with the resident (Art. 14(5)). Beforehand, the residence reports the purpose, the recipients, the database and its owner —in Peru, the controller—, the processor, transfers and the retention period (Art. 18).
- Sensitive data: health data is sensitive (Art. 2(5)), and consent is given in writing, with a handwritten, digital or electronic signature or another method that guarantees the person's will (Regulation, Art. 8).
- Flujo transfronterizo (cross-border flow, the international transfer): to a country with an adequate level or, if it has none, with safeguards such as model contractual clauses, save for exceptions such as performing a contract with the resident (law, Art. 15; Regulation, Arts. 18 to 20). Every flow is reported to the authority for registration (Regulation, Art. 21.2).
- Incidents and officer: a serious security incident is notified to the authority within 48 hours (Regulation, Art. 34), and whoever processes large volumes of data or sensitive data appoints a personal data officer, with deadlines by company size (Art. 37).
Artificial intelligence: the Regulation of Law 31814, published on 9 September 2025, has applied since January 2026. A residence that integrates an assistant is an "implementador" (deployer, Art. 6) and complies with the data rules (Art. 26); the private sector obligations arrive in stages: one year for education and health, two for commerce, four for the rest (first final complementary provision).
What the rules do not say
Worth knowing
No rule says whether a residence is a lease or a lodging agreement: what is agreed and provided decides it. Art. 1727, which extends hospedaje to other places, names hospitals, clubs or restaurants, not residences; but the definition in Art. 1713 covers accommodation with meals and services.
The AI regulation does not name an assistant that answers messages among the high-risk uses: its list covers uses such as assessing minors for admission to a school or deciding about workers, plus a general clause for those that put fundamental rights at risk and are hard to oversee (Art. 24). Everything else, except prohibited uses, is acceptable risk (Art. 22.2). And the fact that the recipient is a processor does not take the sending out of the cross-border flow rule (Regulation, Art. III.15).
Where Bedel comes in
Bedel answers WhatsApp in the language of whoever writes (languages) and leaves on the phone of a person on the team whatever a machine should not decide (escalation to people). Its data is stored in Ireland, inside the European Union, and the AI model runs in the United States under Standard Contractual Clauses. For a residence in Peru, that is a cross-border flow: it is reported to the resident and to the authority. What changes in the contract and in the processing is discussed before signing.
Frequently asked questions
Is there a student accommodation act in Peru?
No. No rule regulates the student residence as an activity. The relationship with the resident is a lease, if the use of the room is granted for rent (Civil Code, Article 1666), or a lodging agreement, if accommodation is provided along with meals or other services (Article 1713). The premises need a municipal operating licence and its technical safety inspection, like any service establishment.
What changed with the new data protection regulation?
Supreme Decree 016-2024-JUS replaced the 2013 regulation and has applied since late March 2025. Among other things, it requires serious security incidents to be notified to the authority within 48 hours, creates the personal data officer for whoever processes large volumes of data or sensitive data, with deadlines by company size, and regulates portability and the right not to be subject to solely automated decisions.
Can I store residents' data outside Peru?
Yes, but it is a cross-border flow. The destination country must have an adequate level of protection or, if not, the sender must provide safeguards, for example model contractual clauses (Law 29733, Article 15; Regulation, Articles 18 to 20). There are exceptions, such as performing a contract to which the resident is a party. In any case, the flow is reported to the authority for entry in the National Register of Personal Data Protection.
Does the artificial intelligence regulation affect a WhatsApp assistant?
It covers it, but does not name it as high risk. The regulation of Law 31814 keeps that category for uses such as assessing minors for admission to a school, deciding about workers or about access to health services, plus a general clause (Article 24); everything else, except what is prohibited, is acceptable risk (Article 22.2). The residence that integrates the assistant is a deployer and has to comply with the personal data rules (Article 26).
What do I need to open the premises?
An operating licence from the district municipality, or from the provincial one where it applies (consolidated text of Law 28976, Articles 3 to 5). The municipality rates the building's risk when it receives the application: at low or medium risk, the licence is automatic and the technical safety inspection comes later; at high or very high risk, the inspection comes first. The certificate lasts two years, and the zoning should be checked beforehand.
Other countries
- MexicoNo act of its own: a lease or a lodging agreement under each state's civil code, civil protection for the building and a federal data protection law that is new since March 2025.
- ColombiaNo act of its own: an urban residential lease or the contrato de pensión of Law 820, commercial lodging, and habeas data under Law 1581 and the SIC.
- ChileNo act of its own: a lease or a lodging agreement, the OGUC's "hogar estudiantil" and a data protection law that changes on 1 December 2026.
- ArgentinaNo national act of its own: the Civil and Commercial Code lease after Decree 70/2023, each municipality's licence, and Law 25.326 with the AAIP.
- SpainThe starting point in Spain: which rule governs the legal figure, the contract, the building, the data and the AI of a student residence, with the guide for each.
- United KingdomFour systems in one country: in England, membership of an approved management code weighs on whether a student building is an HMO and on which contract is signed; data follows UK GDPR.
- IrelandA figure of its own: student specific accommodation, within tenancy law and under the RTB since 2019, whether signed as a lease or as a licence.
- PortugalRules of its own for the building since January 2022 (Decree-Law 14/2022 and Ordinance 35-A/2022); the contract is a Civil Code tenancy and data goes through the GDPR and Law 58/2019.