Mexico Data Privacy Laws: 2025 LFPDPPP Complete Guide

Mexico governs private-sector data privacy through the Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation on March 20, 2025. The law preserves ARCO rights and transfers enforcement from the dissolved INAI to the Secretariat of Anti-Corruption and Good Governance (SABG).

Mexico overhauled its personal data protection framework more significantly in 2024 and 2025 than at any point since the original law passed in 2010. The changes were driven by a sweeping constitutional reform that dissolved seven autonomous constitutional bodies, including the long-standing data protection authority INAI. In their place, enforcement power moved to the executive branch, three new laws entered force on the same day in March 2025, and specialized federal courts took over judicial review from the administrative tribunal system.

For companies operating in Mexico or processing data belonging to Mexican residents, the 2025 framework demands fresh compliance reviews. The new law largely preserves the structure of the 2010 statute, but it introduces changes on consent, automated processing, and privacy notices. The institutional shift from independent regulator to executive ministry also changes the enforcement dynamic in ways that practitioners are still assessing.

This guide covers the full framework: constitutional foundations, the 2025 private sector law, the public sector parallel law, enforcement under the SABG, ARCO rights, penalties, cross-border transfers, and what the current state of regulatory uncertainty means for businesses.

Quick Answer: What You Need to Know

Mexico's data protection regime for the private sector is governed by the 2025 Federal Law for the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, or LFPDPPP). This is a completely new statute, not an amendment. It took effect March 21, 2025, and repealed the 2010 law of the same name.

Enforcement sits with the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno, SABG). The formerly independent INAI no longer exists.

The core data subject rights, ARCO (Access, Rectification, Cancellation, and Opposition), remain the backbone of the framework. Privacy notices are still the central compliance mechanism. Consent rules are largely preserved, with a few important clarifications. Penalties are now expressed in UMA (Unidad de Medida y Actualización) units, replacing the old minimum-wage-based formula.

Mexico also enacted a new public sector data protection law on the same date, alongside transparency legislation. All three statutes are products of the same constitutional overhaul.

Consult an attorney for advice specific to your situation.

Constitutional Basis: Articles 6 and 16

The right to data protection in Mexico has constitutional status. Two articles of the Political Constitution of the United Mexican States establish the foundation.

Article 6 of the Constitution addresses the right to information and freedom of expression. Its second paragraph declares that information regarding private life and personal data shall be protected in accordance with law.

Article 16 provides the more detailed constitutional guarantee. It states that no person shall be disturbed in their private affairs, family, papers, or possessions except pursuant to a written order from competent authority. Crucially, Article 16 also expressly guarantees every person the right to the protection of their personal data, plus the rights to access, rectify, and cancel that data, and to oppose its disclosure. These rights collectively form the constitutional basis for ARCO rights.

The 2010 LFPDPPP was the first federal statute implementing this constitutional mandate for the private sector. The 2025 replacement law continues that lineage while updating the institutional and substantive framework.

The 2024 Constitutional Reform: Why INAI Was Dissolved

Understanding the current framework requires understanding why it changed so abruptly.

In late 2024, the Mexican Congress approved an "organic simplification" constitutional reform aimed at eliminating seven autonomous constitutional bodies. The reform decree ("en materia de simplificación orgánica") was published in the Official Gazette on December 20, 2024. INAI's data protection functions passed to the SABG when the implementing decree took effect on March 21, 2025.

INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales) was among the dissolved agencies. Created in 2014 as an autonomous constitutional body, INAI had served dual roles: national transparency watchdog and data protection authority for both the private and public sectors. It operated with independent commissioners, its own budget, and decision-making authority insulated from executive branch control.

The government's stated rationale was institutional consolidation and efficiency. Critics, including privacy advocates and civil society organizations, raised concerns about the independence implications. INAI's decisions could previously be challenged through administrative litigation before the Federal Court of Administrative Justice. Under the new framework, challenges proceed through specialized federal courts via the amparo constitutional remedy system, a procedural shift that changes the timing and predictability of outcomes.

Data protection proceedings that INAI had started before March 21, 2025 continue before the SABG under the rules in force when they began (transitional article Décimo of the decree).

The Three March 2025 Laws

A single decree published in the Official Gazette on March 20, 2025 issued three statutes, which entered force the next day, March 21, 2025:

1. A new General Law of Transparency and Access to Public Information
2. A new General Law for the Protection of Personal Data Held by Obligated Subjects (LGPDPPSO), governing the public sector
3. A new Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP), governing the private sector

All three statutes formalized the dissolution of INAI and the transfer of its functions to the SABG. For data protection practitioners, the second and third laws are the central instruments.

LFPDPPP 2025: The Private Sector Framework

The 2025 LFPDPPP is structurally similar to the 2010 law but introduces meaningful changes in several areas. Practitioners have described it as an evolution rather than a revolution, with the institutional restructuring being a more dramatic change than the substantive legal provisions.

Scope and Who It Covers

The LFPDPPP applies to any private individual or legal entity that collects, uses, stores, transfers, or otherwise processes personal data. This includes companies, civil associations, and individuals operating in a professional or commercial capacity.

The 2025 law defines the processor (persona encargada, Art. 2, XII) as a person who processes personal data on behalf of the controller, and makes it answerable in damages alongside the controller (Art. 53). The sanctionable infractions, however, are framed as controller conduct (Art. 58). Organizations that act as processors should still define their role contractually.

The law is "de observancia general en todo el territorio nacional" (Art. 1) and contains no express clause on controllers located abroad. The 2011 Reglamento, issued under the repealed 2010 law and not yet replaced (the 2025 decree ordered the regulations adapted within 90 days but neither expressly preserved nor repealed it), states that it applies to processing carried out in an establishment of the controller in Mexico; by a processor, wherever located, on behalf of a controller established in Mexico; by a controller outside Mexico to which Mexican law applies by contract or international law; and by a controller outside Mexico that uses means located in Mexico, other than for mere transit (Reglamento art. 4). Foreign companies serving Mexican residents, including those already navigating the GDPR and CCPA, should assess whether they fall within scope.

The Eight Core Principles

The 2025 LFPDPPP builds on the same foundational principles as its predecessor:

Lawfulness: Processing must comply with Mexican law and may not involve deceptive or fraudulent means.

Consent: Data subjects must provide informed authorization for processing, subject to defined exceptions.

Information: Controllers must inform data subjects about processing through privacy notices delivered at the point of data collection.

Quality: Personal data must be accurate, complete, relevant, and current relative to the stated purposes.

Purpose: Data may only be collected and used for the specific, explicit, and legitimate purposes stated in the privacy notice.

Loyalty: Controllers must process data in ways that respect the data subject's interests and reasonable privacy expectations.

Proportionality: Only data that is necessary, adequate, and relevant for the stated purposes may be processed.

Accountability: Controllers must maintain internal policies, procedures, and documentation to demonstrate ongoing compliance.

The decree gave the Executive 90 days from March 21, 2025 to adapt the regulations to the new law; as of October 2026 the only regulation of the law listed by the Chamber of Deputies was still the 2011 Reglamento.

Personal Data Categories

The law distinguishes categories of personal data, each with different protection thresholds:

General personal data covers names, addresses, email addresses, and phone numbers. Tacit consent (implied through inaction after notification) is generally sufficient for processing.

Financial personal data includes bank accounts, credit card numbers, income information, and credit history. Express, affirmative consent is required.

Sensitive personal data receives the highest protection. The 2025 law defines it as data affecting the most intimate sphere of the data subject, or whose misuse could lead to discrimination or entail a serious risk for them (Art. 2, VI), and names as examples data that may reveal:

• Racial or ethnic origin
• Present or future health status
• Genetic information
• Religious, philosophical, and moral beliefs
• Political opinions
• Sexual preference

The list is illustrative, not exhaustive. The SABG treated the biometric photos collected for the FMF's FAN ID as sensitive data in its 2026 decision. Processing sensitive data requires express written consent (Art. 8), and fines for infractions involving sensitive data can be increased up to twofold (Art. 59).

The 2025 law also expanded the definition of personal data to include individuals who are indirectly identifiable, not just those who can be directly identified.

Privacy Notice Requirements

The privacy notice (aviso de privacidad) remains the cornerstone of the Mexican data protection framework. Under the 2025 law, the notice must be made available from the moment personal data is collected (Art. 2, I; Art. 16).

Full and Simplified Privacy Notices

Full privacy notice: Article 15 requires it to contain at least:

• The identity and domicile of the controller
• The personal data that will be processed, identifying the sensitive data
• The purposes of the processing, distinguishing those that require the data subject's consent
• The options and means the controller offers to limit the use or disclosure of the data
• The mechanisms, means and procedures for exercising ARCO rights
• The procedure and means by which the controller will communicate changes to the notice

The notice must also set out the mechanisms and procedures for revoking consent (Art. 7) and contain a clause stating whether the data subject accepts transfers of their data (Art. 35).

The notice must distinguish the purposes that require the data subject's consent from those that do not (Art. 15, III). If the controller later wants to process data for new purposes, it must obtain fresh consent. Under the 2010 law, processing for "compatible or analogous" purposes did not require re-consent. That compatibility exception no longer exists.

Simplified privacy notice: Required when data is obtained through electronic, optical, audio, visual, or other technological means, such as website cookies. It must contain at least the controller's identity and domicile, the data processed, the purposes, and the options to limit use or disclosure, and say where the full notice can be consulted (Art. 16, II). When data is collected in person on printed forms, the notice must be given at that moment unless it was provided earlier (Art. 16, I). The 2025 statute provides for no third, "short" notice.

Consent Framework

The 2025 LFPDPPP retains Mexico's tiered consent structure and sharpens several requirements:

Tacit Consent

For general personal data, if the privacy notice has been made available to the data subject and they do not express a contrary wish, consent is considered given (Art. 7). The notice must clearly explain this mechanism. Tacit consent remains the default for routine personal information, a departure from the GDPR model that requires affirmative opt-in.

Express Consent

Required for financial or patrimonial data and where other applicable rules require it (Art. 7). Consent is express when the data subject's will is shown verbally, in writing, by electronic or optical means, by unequivocal signs, or by any other technology.

Express Written Consent

Mandatory for sensitive personal data, given through an autograph signature, an electronic signature, or another authentication mechanism established for the purpose (Art. 8).

In all cases, consent must be free, specific, and informed (Art. 2, IV), and personal data may not be obtained or processed through deceptive or fraudulent means (Art. 6). Consent can be revoked at any time, without retroactive effect (Art. 7).

ARCO Rights: Access, Rectification, Cancellation, and Opposition

Mexico's ARCO rights framework predates the GDPR and is one of the most established data subject rights systems in Latin America. The 2025 law strengthened these rights in several specific ways.

Right of Access

Data subjects may request confirmation of whether their personal data is being processed, and if so, access to the data itself along with information about the conditions of processing. Controllers must respond within 20 business days of receiving a valid request.

Right of Rectification

Individuals can request correction of inaccurate, incomplete, or outdated personal data. If the request is granted, the controller must make the correction within 15 business days after communicating its decision (Art. 31).

Right of Cancellation

The 2025 law expanded the scope of this right. Cancellation now explicitly applies to the controller's files, records, expedientes (case files) and systems (Art. 24) where personal data is stored. Cancellation gives rise to a blocking period, after which the data is deleted; during blocking the controller may keep the data only for liabilities arising from the processing. The blocking period equals the limitation period for actions arising from the legal relationship on which the processing is based (Art. 24).

Separately, data about breaches of contractual obligations must be deleted once 72 months have passed from the date of the breach (Art. 10).

Right of Opposition

Data subjects may oppose processing for a legitimate cause where its continuation would cause them harm (Art. 26, I). The 2025 law adds a second ground: automated processing that produces unwanted legal effects or significantly affects their interests, rights or freedoms and is intended to evaluate, without human intervention, personal aspects such as work performance, economic situation, health, sexual preferences, reliability or behavior (Art. 26, II). Opposition does not apply where the processing is needed to meet a legal obligation of the controller.

Exercising ARCO Rights

ARCO requests must be submitted directly to the data controller. The controller has 20 business days to respond and 15 additional business days to implement the approved action, and each period can be extended once for an equal period where the circumstances justify it (Art. 31). Requests are free of charge, except for the costs of reproduction, copies or shipping (Art. 34).

If the controller denies the request or provides an unsatisfactory response, the data subject may file a request for protection of rights with the SABG within 15 days of the controller's response; if the controller does not respond, the request can be filed once the response period has expired (Art. 40). The SABG's resolutions can in turn be challenged by amparo (Art. 51).

Enforcement: The SABG Takes Over from INAI

The most structurally consequential change in the 2025 framework is who enforces the law.

INAI Was Independent; SABG Is Not

INAI operated as an autonomous constitutional body with its own commissioners, budget appropriations, and decision-making authority free from executive interference. Its independence was a deliberate design choice, modeled on data protection authorities in comparable jurisdictions.

The SABG (Secretaría Anticorrupción y Buen Gobierno) is a cabinet-level ministry within the executive branch. It reports to the President. This structural shift places data protection enforcement within the political apparatus of the federal government, a change that privacy advocates have criticized as incompatible with the independence standards set by international frameworks such as Convention 108+ of the Council of Europe.

What SABG Can Do

Article 39 gives the SABG these powers under the private-sector law:

• Monitoring and verifying compliance with the law
• Interpreting the law in the administrative sphere
• Providing technical support to controllers that request it
• Issuing criteria and recommendations
• Publicizing international information-security standards and best practices
• Hearing and resolving rights-protection and verification procedures and imposing sanctions
• Cooperating with other supervisory authorities and national and international bodies, and attending international forums
• Preparing privacy impact studies before a new form of processing is put into practice or existing processing is substantially changed
• Publicizing data protection obligations and training regulated parties

Sanctioning proceedings can be initiated either by data subject complaint or ex-officio by the SABG itself. The investigation and verification process allows the SABG to request documents and information from controllers and processors before any formal finding is issued.

Judicial Review by Amparo

Judicial review of SABG decisions no longer goes to the Federal Court of Administrative Justice. Under Article 51, private parties may challenge the SABG's resolutions through amparo proceedings, heard by specialized judges and courts under Article 94 of the Constitution. The decree ordered the federal judiciary to enable specialized district courts and collegiate circuit courts for access to information and personal data protection within 120 days of March 21, 2025, and suspended procedural deadlines in pending amparo cases in these matters for 180 days (transitional article Vigésimo).

Early Enforcement Activity

In a statement dated July 12, 2026 (Comunicado 078), the SABG announced a fine of MXN 42,849,095 against the Federación Mexicana de Futbol Asociación, A.C. (FMF) over the personal data it processed through its FAN ID system. It found two infractions: the FMF's privacy notice did not tell fans that the photos collected to generate the FAN ID were sensitive biometric data, and the FMF did not obtain express written consent, relying only on a website checkbox without an autograph or electronic signature or another authentication mechanism. The SABG also found breaches of the responsibility and lawfulness principles, and set the amount by reference to the seriousness of the infractions, the sensitive nature of the data and the FMF's economic capacity. The FMF can challenge the decision, and the SABG has said it will defend it.

Penalties and Sanctions

The 2025 LFPDPPP establishes a graduated penalty framework denominated in UMA (Unidad de Medida y Actualización), Mexico's inflation-adjusted economic reference unit. The shift from minimum-wage-based penalties to UMA-based penalties is now formalized in the new statute.

At the 2026 daily UMA rate of MXN 117.31 (approximately USD 5.87 at prevailing exchange rates), penalty ranges are:

Criminal Sanctions

Severe violations can trigger criminal prosecution:

• 3 months to 3 years imprisonment for a person authorized to process personal data who, for profit, causes a security breach of databases in their custody (Art. 62)
• 6 months to 5 years imprisonment for processing personal data through deceit, exploiting the error of the data subject or of the person authorized to transmit the data, to obtain an undue profit (Art. 63)
• These penalties double when the offense involves sensitive personal data (Art. 64)

Administrative sanctions are imposed without prejudice to any resulting civil or criminal liability (Art. 61).

Non-Monetary Sanctions

Apart from fines, the only sanction listed in Article 59 is a warning (apercibimiento) requiring the controller to act on a data subject's ARCO request. Continuing to use personal data illegitimately after the SABG or the data subject has asked for it to stop is itself an infraction in the higher fine band (Art. 58, XVI).

Cross-Border Data Transfers

International data transfers under the 2025 LFPDPPP follow a consent-first model, with several exceptions, unlike the mandatory in-country storage requirements found in some countries' data localization laws.

The General Rule

When a controller transfers personal data to national or foreign third parties other than a processor, it must communicate to them the privacy notice and the purposes to which the data subject limited the processing. The privacy notice must contain a clause stating whether the data subject accepts the transfer, and the recipient assumes the same obligations as the controller that transferred the data (Art. 35).

Exceptions to Consent

Under Article 36, national or international transfers may take place without the data subject's consent when the transfer:

• Is provided for in a law or treaty to which Mexico is a party
• Is necessary for medical prevention or diagnosis, health care, medical treatment, or the management of health services
• Is made to holding companies, subsidiaries or affiliates under the controller's common control, or to a parent or any company of the same group operating under the same internal processes and policies
• Is necessary under a contract concluded or to be concluded in the data subject's interest between the controller and a third party
• Is necessary or legally required to safeguard a public interest or for the administration of justice
• Is needed to recognize, exercise or defend a right in a judicial proceeding
• Is needed to maintain or fulfill a legal relationship between the controller and the data subject

Publicly accessible sources and dissociated data are exceptions to the general consent rule for processing (Art. 9, II and III), not to the transfer rule.

Significant Gap: No Adequacy Framework

Unlike the GDPR, the LFPDPPP does not establish an adequacy determination mechanism, standard contractual clauses as a formal legal instrument, or binding corporate rules. What the law does offer is binding self-regulation: under Article 37, companies may agree among themselves or with civil or governmental organizations, national or foreign, on binding self-regulation schemes, such as codes of good practice or trust seals, which must include mechanisms to measure their effectiveness and corrective measures, and must be notified to the SABG.

The decree gave the Executive 90 days from March 21, 2025 to adapt the regulations. As of October 2026 the only regulation of the law listed by the Chamber of Deputies was still the 2011 Reglamento.

Automated Decision-Making

The 2025 law's only provision aimed at automated decisions is the right of opposition in Article 26, section II: a data subject may oppose automated processing that, without human intervention, produces unwanted legal effects or significantly affects their interests, rights or freedoms, for example by evaluating work performance, economic situation, health, sexual preferences, reliability or behavior.

The law imposes no separate algorithmic-transparency, explanation or impact-assessment duty on businesses. The only privacy impact studies it mentions are prepared by the SABG itself, before a new form of processing is put into practice or existing processing is substantially changed (Art. 39, IX). Organizations using AI systems still have to meet the general principles, privacy notice and consent rules described above.

Public Sector Framework: The New LGPDPPSO

The public sector operates under a separate but parallel framework. The General Law for the Protection of Personal Data Held by Obligated Subjects (Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados, LGPDPPSO) was also replaced with a new version on March 20, 2025, effective March 21, 2025.

The LGPDPPSO applies to all branches and levels of government, including:

• Federal executive agencies and ministries
• Legislative and judicial bodies at all levels
• Autonomous constitutional bodies that survived the reform
• Political parties
• Public trusts and government-created funds

The SABG enforces the private-sector LFPDPPP. Under the LGPDPPSO, competence over public bodies is divided between the SABG and "guarantor authorities" (Autoridades garantes): the judiciary's control and discipline body, the internal control bodies of autonomous constitutional bodies, Congress's internal comptrollers, the INE for political parties, and the equivalent bodies of the states (LGPDPPSO Arts. 2, II and 3, II). Unlike private controllers, public-sector controllers must report significant breaches to the authority as well as to data subjects (LGPDPPSO Art. 34). Individuals whose data is held by government entities can exercise ARCO rights against public bodies through the same basic framework, with procedural variations reflecting the transparency context.

Data Retention and the Data Lifecycle

The 2025 LFPDPPP formalizes data lifecycle management requirements, part of a broader pattern visible across data retention laws worldwide. Personal data that is no longer needed for the purposes set out in the privacy notice must be deleted, after blocking where applicable, once its retention period ends (Art. 10).

Once data is no longer necessary for the stated purposes, controllers must initiate a two-stage process:

Stage 1: Blocking. The data is removed from active processing systems but retained in restricted storage where it cannot be accessed for routine operations. During the blocking period, data exists only for legal compliance or legal proceedings.

Stage 2: Deletion. After the blocking period expires, the data must be permanently destroyed in a way that prevents reconstruction.

The blocking period equals the limitation period for actions arising from the legal relationship (Art. 24). Data about breaches of contractual obligations must be deleted once 72 months have passed from the date of the breach (Art. 10).

Compliance Requirements for Businesses

Organizations subject to the LFPDPPP must implement several structural compliance measures.

Data Protection Function

Article 29 requires every controller to promote data protection within the organization and to designate a person, or a personal data department, to handle data subjects' requests. The law does not create a data protection officer role as such.

Documentation (Good Practice)

The statute does not itemize documentation duties. As evidence that they meet the principles and the privacy notice (Art. 13), controllers commonly keep:

• Current full and simplified privacy notices
• Records of processing activities by purpose and data category
• Documentation of consent mechanisms and revocation procedures
• Data retention schedules with defined blocking and deletion timeframes
• Security incident response procedures
• Records of international data transfers and contractual safeguards
• Evidence of personnel training on LFPDPPP obligations

Security Measures

Article 18 requires administrative, technical, and physical security measures that are no lower than those the controller uses for its own information, taking into account the risk, the possible consequences for data subjects, the sensitivity of the data and technological development. Article 20 requires controls so that everyone involved in processing keeps the data confidential, a duty that continues after the relationship ends.

Breach Response

When a security breach significantly affects data subjects' patrimonial or moral rights, the controller must inform them immediately ("de forma inmediata", Art. 19) so they can take steps to defend their rights. The statute does not list the contents of the notice; the 2011 Reglamento (art. 65) requires at least the nature of the incident, the personal data compromised, recommendations on measures the data subject can take, the corrective actions taken immediately, and where to obtain more information.

The 2025 law contains no duty to notify the SABG of a private-sector breach. Public-sector controllers, by contrast, must also inform the SABG or the relevant guarantor authority (LGPDPPSO Art. 34).

Special Category Rules

Employee monitoring: The LFPDPPP has no employment-relationship exemption, so employee data is subject to the same principles, notice and consent rules.

Children's data: The statute has no specific rule for children's data. The 2011 Reglamento sends the exercise of ARCO rights for minors to the representation rules of the Federal Civil Code (Reglamento art. 89).

Marketing: The Federal Consumer Protection Law applies a separate framework for direct marketing activities, with a 30-day compliance window for consumer opt-out registry obligations.

Current Status and Outlook (October 2026)

The new framework is operational, but several pieces remain open.

Implementing regulations: The decree gave the Executive 90 days from March 21, 2025 to adapt the regulations. As of October 2026 the Chamber of Deputies still listed only the 2011 Reglamento issued under the repealed 2010 law, so it remains the main source of procedural detail where it is consistent with the new statute.

Enforcement: In July 2026 the SABG announced a MXN 42,849,095 fine against the Federación Mexicana de Futbol over its FAN ID system, a decision the FMF can challenge.

Judicial interpretation: SABG resolutions are challenged by amparo before specialized federal courts (Art. 51). Amparo case law on the new law will develop gradually.

For businesses operating in Mexico, the practical path is to comply with the 2025 law as written, monitor the Official Gazette for implementing regulations and any further legislative developments, and maintain documentation demonstrating proactive compliance. For recording laws in Mexico, separate consent and wiretapping rules apply under the Federal Penal Code. Consult an attorney for advice specific to your situation.

Frequently Asked Questions

What is the LFPDPPP and does it apply to my company?

The LFPDPPP (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) is Mexico's federal data protection law for the private sector. A completely new version took effect on March 21, 2025, replacing the original 2010 statute. It applies to private individuals and legal entities that process personal data. The 2025 version defines processors and makes them answerable in damages, but its sanctionable infractions are framed as controller conduct. The statute has no express clause on foreign companies; the 2011 Reglamento, which has not yet been replaced, says it reaches, among others, processing in an establishment in Mexico and a foreign controller that uses means located in Mexico, so a company outside Mexico that handles data of people in Mexico should assess whether it is covered.

What happened to INAI and who enforces Mexico's data privacy laws now?

INAI, Mexico's formerly independent data protection authority, was dissolved following a constitutional reform published December 20, 2024, as part of an organic simplification measure eliminating seven autonomous bodies. Its enforcement functions transferred to the Secretariat of Anti-Corruption and Good Governance (SABG), a cabinet-level executive branch ministry, effective March 21, 2025. The SABG now resolves rights-protection requests, conducts verification procedures, and imposes sanctions. Critics have raised concerns about the loss of institutional independence, since the SABG reports to the President rather than operating as an autonomous body.

What are ARCO rights under Mexican law?

ARCO stands for Access, Rectification, Cancellation, and Opposition. These rights allow individuals to: confirm whether their personal data is being processed and access it; correct inaccurate or incomplete information; request deletion of their data once it is no longer needed; and object to processing for specific purposes. The 2025 law extended the opposition right to automated processing that, without human intervention, produces unwanted legal effects or significantly affects a person's interests, rights or freedoms. Requests go directly to the data controller, which has 20 business days to respond, extendable once. If the controller denies or ignores the request, individuals can file a request for protection of rights with the SABG within 15 days of the response (or once the response period has passed), and the SABG's resolution can be challenged by amparo.

What are the maximum fines under Mexico's 2025 data protection law?

Administrative fines are denominated in UMA (Unidad de Medida y Actualización), Mexico's annual inflation-adjusted reference unit. At the 2026 daily UMA rate of MXN 117.31, the maximum standard fine for aggravated violations reaches approximately MXN 37.5 million (roughly USD 1.9 million). For violations involving sensitive personal data, fines can be increased up to twofold, to a maximum of approximately MXN 75 million (roughly USD 3.75 million). Repeat offenders face additional penalties of up to the same maximum amount. Criminal sanctions include 3 months to 3 years in prison for an authorized person who, for profit, causes a security breach of databases in their custody, and 6 months to 5 years for processing data through deceit to obtain an undue profit, doubled for sensitive data. In July 2026 the SABG announced a fine of MXN 42,849,095 against the Federación Mexicana de Futbol for failing to identify FAN ID biometric photos as sensitive personal data and processing them without express written consent.

Does Mexico's data protection law address AI and automated decision-making?

Only narrowly. The 2025 LFPDPPP's one provision on automated decisions is a right of opposition (Art. 26, II): a person may oppose automated processing that, without human intervention, produces unwanted legal effects or significantly affects their interests, rights or freedoms, such as evaluations of work performance, economic situation, health or behavior. The law does not require businesses to disclose algorithmic logic or carry out impact assessments; the only privacy impact studies it mentions are prepared by the SABG itself. The general principles, notice and consent rules apply to AI systems like any other processing.

How do cross-border data transfers work under Mexico's LFPDPPP?

The controller must communicate the privacy notice and the agreed purposes to the recipient, the notice must contain a clause stating whether the data subject accepts the transfer, and the recipient assumes the same obligations as the transferring controller (Art. 35). Article 36 lists seven cases where consent is not needed, including transfers provided for by law or treaty, transfers within the same corporate group, transfers needed under a contract in the data subject's interest, and transfers for health care or to defend a right in court. Unlike the GDPR, the LFPDPPP has no adequacy decisions or standard contractual clauses; Article 37 allows binding self-regulation schemes notified to the SABG.

Is mandatory breach notification to the SABG required?

Not for private-sector controllers. The 2025 LFPDPPP requires controllers to inform affected data subjects immediately when a security breach significantly affects their patrimonial or moral rights (Art. 19), but it contains no duty to notify the SABG. The 2011 Reglamento requires the notice to data subjects to cover at least the nature of the incident, the data compromised, recommendations, the corrective actions taken and where to get more information. Public-sector controllers under the LGPDPPSO must also inform the SABG or the relevant guarantor authority.

What is Mexico's constitutional basis for data protection?

The right to personal data protection is guaranteed by two articles of Mexico's Political Constitution. Article 6 states that information about private life and personal data shall be protected in accordance with law. Article 16 expressly recognizes every person's right to protection of their personal data and their rights to access, correct, and cancel that data, and to oppose its disclosure. These constitutional rights set the floor for protection that legislation must meet.