81%
of Mexico's 21 requirements are already met by European Union (GDPR). Here is what LFPDPPP adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
LFPDPPP adds3 Consent is the default basis; processing without consent only under listed exceptions (law, public sources, legal relationship, emergency, health care, court order). No legitimate interests.
Arts. 7, 9 · source ↗
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
LFPDPPP adds3 Every controller must designate a person or data protection department to handle ARCO requests and promote data protection internally.
Art. 29 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
LFPDPPP adds2 Data must be blocked, then deleted, once purposes end; records of contractual defaults must be deleted after 72 months.
Arts. 2(III), 10, 24 · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
LFPDPPP adds2 Imprisonment of 3 months to 3 years for profit-driven breaches by authorized persons and 6 months to 5 years for deceptive processing; doubled for sensitive data.
Arts. 62-64 · source ↗
Already covered by GDPR: Reach abroad, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO qualifications, Registration, DPIA, Records, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Private action.
A gap means LFPDPPP is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
