Regulations › Rest of world › Mexico
LFPDPPP
Federal Law on the Protection of Personal Data Held by Private Parties
WhenIn effect since 21 March 2025
Who enforces itSecretaría Anticorrupción y Buen Gobierno (SABG)
Who it applies toPrivate individuals and companies that process personal data in Mexico.
Tell the regulatorNo duty to notify the regulator
DPO requiredEvery controller must designate a person or data protection department to handle ARCO requests…
RegistrationNo registration or notification of databases with the regulator
Transfers abroadDomestic and international transfers need consent via the privacy notice, with listed exceptions
Request deadlineRespond within 20 business days and implement within 15 business days
Maximum fineUp to 320,000 UMA (about MXN 36 million, roughly USD 2m), doubled for sensitive data, plus an…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
1
Law applies nationwide; the Regulation also reaches non-established controllers that use means located in Mexico (other than transit).Art. 1 LFPDPPP; Art. 4 Regulation (2011) · source ↗
2011 Regulation still applied where not contrary to the 2025 Law; the Executive was to harmonize regulations (Transitorio Décimo Segundo). References to INAI now read as the Secretaría.
Lawful basis
3
Consent is the default basis; processing without consent only under listed exceptions (law, public sources, legal relationship, emergency, health care, court order). No legitimate interests.Arts. 7, 9 · source ↗
Consent
1
Tacit consent via privacy notice is valid by default; express consent for financial or patrimonial data; express written consent for sensitive data.Arts. 7, 8 · source ↗
Sensitive data
2
Sensitive data needs express written consent (signature, e-signature or other authentication); databases of sensitive data need a legitimate, specific justification.Arts. 2(VI), 8 · source ↗
Children
0
No child-specific rule or age threshold; minors act through representatives under the Federal Civil Code (minority ends at 18).Art. 89 Regulation (2011) · source ↗
2011 Regulation still applied where not contrary to the 2025 Law; the Executive was to harmonize regulations (Transitorio Décimo Segundo). References to INAI now read as the Secretaría.
People's rights
Rights
2
ARCO rights: access, rectification, cancellation and opposition, including objection to automated processing with significant effects. No portability right.Arts. 22-26 · source ↗
Automated-decision protection exists only as an opposition ground (Art. 26(II)).
Request deadline
2
Respond within 20 business days and implement within 15 business days; each extendable once.Art. 31 · source ↗
Business days (Art. 2(VIII)); 20 business days is roughly four calendar weeks.
Marketing
1
Marketing is a secondary purpose disclosed in the privacy notice; data subjects can object or opt out.Art. 26; Art. 30 Regulation (2011) · source ↗
Federal consumer law (PROFECO's REPEP do-not-call registry) also applies; not reviewed.
Governance
DPO required
3
Every controller must designate a person or data protection department to handle ARCO requests and promote data protection internally.Art. 29 · source ↗
DPO qualifications
0
No qualifications set for the designated person or department.Art. 29 · source ↗
Registration
0
No registration or notification of databases with the regulator.Not addressed · source ↗
DPIA
1
No DPIA duty for controllers; the Regulation requires a security risk analysis and review of risks from new products or technologies.Arts. 48(V), 61(III) Regulation (2011) · source ↗
Art. 39(IX) of the Law gives the Secretaría power to run privacy impact studies, not a controller duty.
Records
1
Regulation requires an inventory of personal data and processing systems as a security measure; not filed with the regulator.Art. 61(I) Regulation (2011) · source ↗
2011 Regulation still applied where not contrary to the 2025 Law; the Executive was to harmonize regulations (Transitorio Décimo Segundo). References to INAI now read as the Secretaría.
Retention
2
Data must be blocked, then deleted, once purposes end; records of contractual defaults must be deleted after 72 months.Arts. 2(III), 10, 24 · source ↗
Breaches
Tell people
2
Notify data subjects immediately of breaches that significantly affect their patrimonial or moral rights.Art. 19; Arts. 64-65 Regulation (2011) · source ↗
Transfers
Transfers abroad
2
Domestic and international transfers need consent via the privacy notice, with listed exceptions; recipient assumes the controller's obligations, typically by contract.Arts. 35-36; Arts. 74-75 Regulation (2011) · source ↗
Enforcement
Maximum fine
2
Up to 320,000 UMA (about MXN 36 million, roughly USD 2m), doubled for sensitive data, plus an additional fine of up to 320,000 UMA for repeat violations.Art. 59 · source ↗
Peso estimate uses the 2025 UMA of MXN 113.14; check the current UMA value.
Criminal liability
2
Imprisonment of 3 months to 3 years for profit-driven breaches by authorized persons and 6 months to 5 years for deceptive processing; doubled for sensitive data.Arts. 62-64 · source ↗
Private action
2
Administrative sanctions apply without prejudice to civil liability, so data subjects can claim damages in the civil courts.Art. 61 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws