Mexico Data Protection Law Guide: The 2025 Federal Law, Security Duties and Breaches

Mexico replaced its 2010 private sector data protection law in March 2025 and moved enforcement from the INAI to a government ministry, so compliance programmes built on the old law and the old regulator need to be checked again. The new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) was published in the Diario Oficial de la Federación (DOF) on 20 March 2025 and took effect the next day. It keeps the familiar architecture of privacy notices, consent, ARCO rights and security measures, but changes the authority, the sanction unit, the redress route and several definitions. This guide is for security, privacy and engineering teams at companies that process personal data in Mexico, or about people in Mexico, and it focuses on what the law asks of security functions: security measures, breach communication to data subjects, confidentiality, processors and transfers. Article numbers below refer to the 2025 law as consolidated by the Chamber of Deputies (last reform DOF 14 November 2025).

Key takeaways

• A new law, not an amendment. The 2025 LFPDPPP abrogates the law of 5 July 2010 (Transitorio Segundo) and has been in force since 21 March 2025.
• The regulator is now the Secretaría Anticorrupción y Buen Gobierno. The December 2024 constitutional reform extinguished the INAI, and the new law names the Secretaría as the authority (Art. 2, fr. XV); pending INAI procedures continue before it.
• Security duties are principle based. Art. 18 requires administrative, technical and physical measures no weaker than those you use for your own information, scaled to risk, harm, data sensitivity and technology.
• Breaches go to the data subject, immediately. Art. 19 requires you to inform affected people without delay when a breach significantly affects their patrimonial or moral rights, so they can protect themselves.
• Fines are now set in UMA. Art. 59 sets ranges of 100 to 160,000 and 200 to 320,000 UMA, with an additional fine for persistence and up to double for sensitive data, plus criminal offences in Arts. 62 to 64.

Scope: who and what is covered

The law applies to private parties, individuals and legal entities, that process personal data (Art. 2, fr. XVI defines these "sujetos regulados"). Public sector bodies are covered by a separate general law, the Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados, issued in the same decree of 20 March 2025.

The law sets limits on rights and principles for national security, public order, public security and health, and third party rights (Art. 3). It does not contain a GDPR style territorial targeting clause in the provisions reviewed here, so foreign groups should take local advice on whether their Mexican operations, subsidiaries or processors bring them within scope.

Key obligations

Principles, notice and consent

• Principles: lawfulness, purpose, loyalty, consent, quality, proportionality, information and accountability (Art. 5).
• Privacy notice (aviso de privacidad): must be available from the moment data is collected (Art. 2, fr. I and Art. 14). Minimum content in Art. 15: controller identity and address, the data processed (flagging sensitive data), purposes, options to limit use, how to exercise ARCO rights and how changes are communicated. For electronic collection, a simplified notice that points to the full notice is allowed (Art. 16).
• Consent: required by default and may be express or tacit (Art. 7). Tacit consent works where the notice was made available and the person did not object. Financial or patrimonial data needs express consent, and sensitive data needs express written consent by handwritten signature, electronic signature or another authentication mechanism (Art. 8). Consent can be revoked at any time without retroactive effect.
• Exceptions to consent: legal requirement, public sources, dissociated data, a legal relationship with the data subject, emergencies, medical care and orders of a competent authority (Art. 9).

Commentary from Garrigues notes that the law no longer expressly requires the notice to describe transfers, while the regulation still does, so keeping a transfer section in the notice remains the prudent choice.

Security, confidentiality and breaches

Two points matter for incident response. First, the notification duty in Art. 19 runs to the data subject, and the text reviewed names no duty to notify the Secretaría. Second, "immediately" leaves no fixed clock, so define internally what triggers the assessment and who signs off. Contracts with processors should require them to tell you quickly enough that you can meet this duty. For how Mexico compares with fixed-deadline regimes, see the Breach Notification Laws by Country Guide.

Data subject rights (ARCO)

• Rights: access, rectification, cancellation and opposition, each independent of the others (Art. 21).
• Automated processing: people may object where processing without human intervention produces unwanted legal effects or significantly affects them, for example by evaluating economic situation, health or behaviour (Art. 26, fr. II).
• Deadlines: respond within 20 days and give effect to a favourable decision within the following 15 days; each period can be extended once (Art. 31).
• Cost: free except reproduction or shipping costs; repeat requests within 12 months cost no more than three UMA (Art. 34).
• Escalation: a data subject can file a protection request with the Secretaría within 15 days of the response (Art. 40), and the Secretaría has 50 days to resolve, extendable once (Art. 42).

Transfers and processors

• Transfers (Art. 35): give the recipient the privacy notice and purposes; the notice must include a clause stating whether the data subject accepts the transfer; the recipient takes on the same obligations as the controller. This applies to domestic and international recipients alike.
• Transfers without consent (Art. 36): seven cases, including a law or treaty, medical need, transfers within the same corporate group operating under common processes and policies, contracts in the data subject's interest, public interest, judicial proceedings and maintaining the legal relationship.
• Processors: the law defines the encargado but the provisions reviewed do not set detailed processor duties, so the contract carries the weight: instructions, security, confidentiality, sub-processing, breach reporting and return or deletion.
• Self-regulation (Art. 37): binding self-regulation schemes may complement the law if they include effectiveness measures and corrective actions and are notified to the authorities.

For a cross-jurisdiction view of transfer mechanisms, see the International Data Transfers Map.

Timeline and current status

Regulation: the law refers throughout to its Reglamento (Art. 2, fr. XIII), but its transitional articles do not say whether the 2011 regulation of the old law survives, and Transitorio Décimo Segundo only orders regulations in general to be adjusted. Until a new regulation is published, treat the status of detailed requirements from the old regulation as uncertain, and check the DOF before relying on them.

Enforcement and penalties

The Secretaría monitors and verifies compliance (Art. 39, fr. I) and can open verification ex officio or on request, with access to the information and documents it considers necessary (Arts. 54 and 55). Obstructing verification is itself an infraction (Art. 58, fr. XIV). Resolutions are challenged by amparo before specialised judges and courts, replacing the nullity suit before the Federal Court of Administrative Justice.

Art. 60 lists the criteria: nature of the data, whether a refusal was justified, intent, economic capacity and recidivism. Criminal offences sit alongside: three months to three years in prison for someone authorised to process data who causes a security breach for profit (Art. 62), six months to five years for processing data through deception to obtain an undue gain (Art. 63), doubled for sensitive data (Art. 64). The UMA value is updated annually, so convert using the current figure.

What it means for AI agents and non-human identities

The law does not mention AI agents, but several duties land directly on the machine identities that move personal data around.

• Art. 18 "no weaker than your own information": service accounts, API keys and agent tokens that can read customer or employee data must be protected at least as well as the credentials guarding your own financial systems. Vault them, scope them and rotate them. See the Secrets Management Guide.
• Art. 19 breach assessment: leaked tokens for a CRM or HR SaaS are a breach path. Your severity criteria should cover machine credential exposure, not only lost laptops and ransomware.
• Art. 20 confidentiality after the relationship ends: when a contractor or vendor leaves, the integrations and keys they created must be revoked too. See the NHI Offboarding and Decommissioning Guide.
• Art. 26, fr. II automated processing: agents that score, approve or decline people without human review can trigger an objection right. Log decisions, keep a human route, and constrain what the agent may do. See the AI Agent Authorisation Guide.
• Arts. 35 and 36 transfers: an agent calling a third party model or API with personal data may be making a transfer or a processor engagement. Inventory those flows and cover them in the notice or contract.

Compliance steps

1. Re-baseline against the 2025 text. Map each control and notice to the new article numbers; references to the 2010 law, the INAI and minimum wage multiples are now wrong.
2. Inventory processing and flows. Record data categories, sensitive data, systems, processors, transfers and the machine identities with access. See the Data Classification Guide.
3. Refresh privacy notices. Full and simplified versions, Art. 15 content, transfer acceptance clause, and separate consent for any new purpose.
4. Document the Art. 18 risk analysis. For each processing activity, record risk, possible consequences, sensitivity and chosen measures; prioritise sensitive and financial data.
5. Build the Art. 19 runbook. Define "significant effect", owners, evidence, the message content (what happened, what data, what the person can do) and the target time from detection to notice. Test it in a tabletop that includes a leaked API key.
6. Fix processor and recipient contracts. Security, confidentiality, breach reporting to you, sub-processing, and deletion at end of service.
7. Stand up the ARCO function. Designate the person or department (Art. 29), track 20 plus 15 day deadlines, and include automated decision objections.
8. Watch the regulator. Monitor the DOF and the Secretaría for the new regulation and guidance, and review the programme when they appear.

To compare Mexico with other regimes in the region, see the Brazil LGPD Guide, the Argentina Data Protection Law Guide and the Global Privacy Regulatory Map.

Measuring it

• Notice coverage: share of collection points (web, app, paper, call centre) showing a current 2025-compliant notice.
• ARCO timeliness: percentage of requests answered within 20 days and implemented within 15.
• Breach decision time: median hours from detection to a documented Art. 19 decision.
• Credential hygiene: share of machine credentials with access to personal data that are vaulted, owned and rotated on schedule.
• Contract coverage: share of processors and recipients with security, breach and deletion clauses.

Framework mapping

Common failure patterns

• Treating the 2025 law as a cosmetic update. Notices and policies still cite the INAI and the 2010 articles, which undermines credibility in a verification.
• Waiting for a regulator notification duty that does not exist. Teams copy a GDPR 72-hour playbook to the regulator and forget that the Mexican duty is to the affected people, immediately.
• Ignoring domestic transfers. Sharing with another Mexican company is still a transfer under Art. 2, fr. XX.
• Tacit consent stretched too far. Financial and sensitive data need express consent, and sensitive data needs written consent.
• Machine credentials outside the security baseline. Integration keys to HR or CRM systems are long lived and unowned, which fails the Art. 18 "no weaker than your own" test.

Practitioner checklist

• Update every policy, notice and contract reference from the 2010 law and the INAI to the 2025 law and the Secretaría Anticorrupción y Buen Gobierno.
• Maintain an inventory of processing, sensitive data, processors, transfers and machine identities with access.
• Publish full and simplified privacy notices with Art. 15 content and a transfer acceptance clause.
• Record an Art. 18 risk analysis and control set per processing activity.
• Adopt an Art. 19 breach runbook with severity criteria, owners and data subject message templates, and test it.
• Vault, scope, own and rotate every credential that can reach personal data.
• Put security, confidentiality, breach reporting and deletion clauses in processor and recipient contracts.
• Designate the personal data person or department and track ARCO deadlines.
• Monitor the DOF for the new regulation and Secretaría guidance.

Standards and references

• Orden Jurídico Nacional: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025)
• Cámara de Diputados: LFPDPPP consolidated text
• Cámara de Diputados: LFPDPPP reform history
• KPMG México: Extinction of autonomous bodies in Mexico
• Greenberg Traurig: Extinction of autonomous bodies and regulators
• Garrigues: Mexico's new federal law on personal data held by private parties
• KPMG México: New LFPDPPP flash

This guide summarises Mexico's Federal Law on the Protection of Personal Data Held by Private Parties as published and consolidated by official sources at the date shown, and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Brazil LGPD Guide · Breach Notification Laws by Country Guide · International Data Transfers Map