Regulations › Rest of world › Mexico
LFPDPPP
Federal Law on the Protection of Personal Data Held by Private Parties
WhenIn effect since 21 March 2025
Who enforces itSecretaría Anticorrupción y Buen Gobierno (SABG)
Who it applies toPrivate individuals and companies that process personal data in Mexico.
Tell the regulatorNo duty to notify the regulator
DPO requiredEvery controller must designate a person or data protection department to handle ARCO requests…
RegistrationNo registration or notification of databases with the regulator
Transfers abroadDomestic and international transfers need consent via the privacy notice, with listed exceptions
Request deadlineRespond within 20 business days and implement within 15 business days
Maximum fineUp to 320,000 UMA (about MXN 36 million, roughly USD 2m), doubled for sensitive data, plus an…
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws