Carlos Hermoza, Legal and Compliance Manager and Data Protection Officer at Valmer Systems, a Peruvian IT infrastructure, technical support, and technology consulting company, views data protection as an integral part of the company’s strategic business decisions. This perspective explains how he leads a triple responsibility that requires integrating functions while preserving their independence, and how he translates legal criteria into the operations of a company that manages the infrastructure where other organizations host their information. Drawing on this experience, he analyzes the requirements of the new Peruvian data protection regulations, in effect since March 2025, and the challenges that artificial intelligence poses for information governance leading up to 2027. During his participation in the Foro Gerencias Legales Lima 2026, he argues that data protection should be a priority on the agenda of senior management. According to Hermoza, “when compliance is integrated into the business, integrity becomes part of the culture.”
What sparked your interest in personal data protection during your legal career?
My interest stems from a conviction that has run throughout my career: the legal function must understand how businesses operate and how their decisions affect people. From legal management and compliance, information constantly appears in contracts, employment relationships, investigations, and business transactions. Delving deeper into data protection has allowed me to approach these decisions with a more comprehensive perspective, especially in an environment where technology expands the possibilities for using personal information.
My experience as a regional compliance officer also provides a relevant perspective. Working with different regulatory frameworks requires understanding the context of each operation and translating obligations into criteria that people can apply. Data protection requires this same exercise: knowing what information is used, for what purpose, who can access it, and what the consequences of its use might be. My specialized training has strengthened this connection between legal analysis and day-to-day management.
At Valmer Systems, this matter takes on a very specific dimension due to our technological activity. Decisions regarding infrastructure, support, or access to systems can affect the information that other organizations entrust to us. This requires aligning legal criteria with technical decisions. For me, protecting personal data is a way of exercising legal management that contributes to business development and respects the people who make that development possible.
You combine the legal, compliance, and data protection functions. What does this triple responsibility demand of the person leading it?
It requires sound judgment to integrate the three functions and clarity to distinguish their responsibilities. From Legal, we support decision-making and structure business relationships; from Compliance, we promote conduct and controls that enable integrity; and from Data Protection, we advise on and verify how personal information is handled. Each function brings a distinct perspective to the same operation. Leading them requires understanding the business objective and anticipating its implications before they become a contingency.
This integration requires safeguarding independence. The accumulation of roles necessitates reviewing potential conflicts of interest, defining the decisions that fall within each function’s purview, and establishing independent review mechanisms when necessary. It also requires access to senior management and resources commensurate with the risk. Those who hold these responsibilities must be able to identify significant exposure, substantiate their position, and escalate it promptly, even when there is pressure to close a deal or accelerate a project.
In my case, I consider it essential to work closely with the commercial and technical teams, using language that facilitates decision-making. A recommendation should explain the existing risks, the viable alternatives, and the conditions that allow for progress. Furthermore, its implementation requires accountability and follow-up. When compliance is integrated into the business, integrity becomes part of the culture. That is the consistency that those of us who lead these functions must strive for.
In a company that manages technological infrastructure for other companies, what responsibility does it assume regarding customer data?
We assume a responsibility that begins with understanding the true scope of each service. At Valmer Systems, we work with IT infrastructure solutions, support, and consulting, so we must identify when an intervention involves the processing of personal data. If we are acting on behalf of the client, we must define our role as data processor and adhere to their instructions. This status is not presumed simply by being a technology provider; it depends on what we actually do and who decides the purpose and means of the processing.
For me, that responsibility must be reflected in the contract and in the operation. It’s necessary to define what access technical personnel need, how that access is authorized and logged, what obligations extend to other providers, and how backups or information are handled upon completion of the service. A simple example is remote support: resolving an incident may require access to a system, but that access must be limited to what is necessary for the task. Therefore, confidentiality must be accompanied by concrete and verifiable controls.
Coordination in incident response is also crucial. When acting as the service provider, immediate communication with the responsible party allows the client to assess their obligations and take timely action. Escalation channels and evidence preservation procedures must be in place. My approach is that the quality of the technology service includes safeguarding information throughout its delivery. The client needs operational continuity and also clarity on how the personal information that the service may involve is protected.
The new regulations for the Personal Data Protection Law have been in effect in Peru since 2025. What changes have they required of companies?
The regulations approved by Supreme Decree No. 016-2024-JUS, in effect since March 31, 2025, have raised management standards. Companies need to review their data processing practices and demonstrate how they comply in practice. This involves understanding information flows, verifying the purposes and legal basis for processing, and reviewing the controls and contracts that support each operation. My managerial perspective is that compliance requires a program with priorities, assigned responsibilities, and evidence of implementation.
A key new requirement is the obligation to notify the National Data Protection Authority of certain incidents within 48 hours of becoming aware of them, in accordance with the regulations. This timeframe demands the capacity for detection, assessment, and coordination. Preparedness must allow for timely decisions regarding appropriate communications, preservation of evidence, and mitigation of the incident’s impact. This responsibility requires the involvement of the Technology, Legal, and operational management teams.
The regulation also incorporates the designation of a Data Protection Officer in the cases provided for, with a phased implementation for certain private organizations. It is necessary to review the specific obligations and deadlines applicable to each company. Furthermore, data portability is expanded, and the protection of individuals’ rights is strengthened. The regulation also includes, on an optional basis, a data protection impact assessment prior to processing, which I consider particularly useful for operations with significant risks.
From my experience in legal and compliance management, the most significant change lies in how this area is handled. Senior management must understand the company’s exposure and monitor how it is addressed. A compliance program is most effective when it allows for the identification of a breach, the allocation of resources, and verification that corrective measures are working. This discipline helps ensure that data protection remains current in the face of new services, providers, and uses of information.
Looking ahead to 2027, what challenges does artificial intelligence pose for the protection of personal data?
Looking ahead to 2027, I see a key challenge in companies’ ability to govern the use of artificial intelligence. These systems allow for combining information, inferring characteristics about a person, and producing recommendations that influence decisions about them. Evaluation must encompass both the input data and the resulting profiles or outcomes. The fact that information is available online, even on a professional network, does not automatically authorize its reuse.
This has concrete implications for personnel selection, customer evaluation, and employee monitoring. An inaccurate or biased result can affect opportunities and rights. Therefore, I believe it is necessary to review the legitimacy and purpose of the data processing, the quality of the data, and the degree of human intervention. This human review must be effective: the responsible person needs to understand the result, have sufficient information, and have the authority to correct it. The provider’s conditions should also be evaluated, especially if they use the received data to train their own models.
My regional experience also leads me to consider where information is processed and which third parties are involved. From Valmer Systems’ perspective, as a technology solutions company, we must understand these dependencies to support informed decisions. I recommend identifying use cases, assessing their risks before implementation, and assigning responsibilities to monitor their performance. Assistants capable of performing tasks add a particular requirement regarding permissions and traceability. The adoption of AI must proceed with clear criteria regarding what information can be used, who is accountable for the decisions, and how to correct a detrimental outcome.
You are participating in the Foro Gerencias Legales Lima 2026. What place should data protection occupy on the agenda of legal managers?
Data protection must be integrated into the company’s strategic decisions. It permeates relationships with clients and employees, supplier contracts, and the development of digital services. The legal manager needs to be involved when a project is defined, because that’s where decisions are made about what information will be used and what dependencies will be created. Incorporating this analysis from the outset allows for the development of alternatives and avoids corrections that could later be costly or difficult to implement.
It should also be present in the conversation with senior management and, where appropriate, with the board of directors. This conversation requires highlighting the most significant risks, the necessary measures, and the progress of their implementation. Indicators such as reviewed critical treatments, timely fulfilled entitlement requests, and outstanding corrective actions are useful. This information should enable informed decisions regarding resources and priorities, with a clear understanding of the potential impact of a failure on people and operations.
At the Forum, I’m interested in contributing from the perspective of the connection between legal management, compliance, and technology, enriched by my regional experience. In a company like Valmer Systems, understanding the business means understanding how the service is delivered and how information flows during its execution. This close understanding allows me to formulate applicable recommendations and support them with sound legal judgment. I believe the value of legal management is demonstrated by the quality of the decisions it helps to make; data protection is now an indispensable part of that responsibility.
