Skip to content
AI Policy Generator

ESWhat applies

Mexico · Law

Federal Law on the Protection of Personal Data Held by Private Parties (2025)

In forceLFPDPPP 2025

Summary

This is the private-sector personal data law. It replaced the 2010 law and moved oversight from the former INAI to the Ministry of Anti-Corruption and Good Governance. It requires a privacy notice, consent for new purposes and security measures, and it gives people the right to object to automated processing without human involvement that significantly affects them (art. 26). It does not regulate AI specifically or require impact assessments, but any AI system that uses personal data must comply with it.

Who it applies to

Individuals and private companies that process personal data in Mexico, including processors acting on behalf of others.

Penalties

Warnings and fines of 100 to 160,000 UMA or 200 to 320,000 UMA depending on the violation, plus an additional fine for repeat violations; they can increase when sensitive data is involved (art. 59).

Official name
Ley Federal de Protección de Datos Personales en Posesión de los Particulares
Official reference
Expedida por el Decreto publicado en el DOF el 20 de marzo de 2025 (edición vespertina), en vigor desde el 21 de marzo de 2025; abroga la ley de 2010
Regulator
Ministry of Anti-Corruption and Good Governance (SABG)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Privacy notice that covers AI usesLFPDPPP 2025, arts. 14 a 16In forceMarch 21, 2025If you process personal data in Mexico, including when you use it in AI systems (chatbots, profiling, analytics).Verified in the official source on November 4, 2026
Fresh consent to use data in AI for new purposesLFPDPPP 2025, art. 11In forceMarch 21, 2025If you want to use personal data you already hold for an AI purpose that was not in the original notice, for example training or fine-tuning models.Verified in the official source on November 4, 2026
Contracts with processors, including AI vendorsLFPDPPP 2025, arts. 2, fr. XII, y 20; Reglamento de 2011 (contenido del contrato)In forceMarch 21, 2025If a vendor (cloud, AI tool, agency) processes personal data on your company's behalf.Pending confirmation in the official source (last checked: November 4, 2026)
Data transfers to third parties and other countriesLFPDPPP 2025, arts. 2, fr. XX, 35 y 36In forceMarch 21, 2025If you send personal data to third parties or to vendors outside Mexico, such as cloud AI services.Verified in the official source on November 4, 2026
Security measures and breach noticesLFPDPPP 2025, arts. 18 y 19In forceMarch 21, 2025If you process personal data, including data that goes into or comes out of AI systems.Verified in the official source on November 4, 2026
Handle access, correction, deletion and objection (ARCO) requestsLFPDPPP 2025, arts. 21 a 34In forceMarch 21, 2025If you process personal data of customers, employees or users.Verified in the official source on November 4, 2026

Privacy notice that covers AI uses

LFPDPPP 2025, arts. 14 a 16In force

Applies from March 21, 2025

When it relates
If you process personal data in Mexico, including when you use it in AI systems (chatbots, profiling, analytics).
What the rule provides
  • Keep a full privacy notice and, for online channels, a short notice that links to the full one.
  • Separate, in the notice, purposes that need consent from those that do not.
  • Describe each relevant AI use of personal data as a purpose (for example, automated customer service, profiling or model improvement).
Typical evidence
  • Full and short notices published, with date and version.
  • Map of purposes per AI system.
Verification
Verified in the official source on November 4, 2026Checked against the statute text published in the DOF (Decree of Mar 20, 2025, article three): arts. 14 and 15 (notice contents; sec. III: separate purposes that need consent) and art. 16 (short notice online linking to the full notice). Describing each AI use as a purpose relates to art. 15. In force since Mar 21, 2025 (first transitional article).

Contracts with processors, including AI vendors

LFPDPPP 2025, arts. 2, fr. XII, y 20; Reglamento de 2011 (contenido del contrato)In force

Applies from March 21, 2025

When it relates
If a vendor (cloud, AI tool, agency) processes personal data on your company's behalf.
What the rule provides
  • Sign a contract with each processor that limits data use to your instructions and requires confidentiality and security. The 2025 law defines the processor and requires confidentiality from everyone involved in processing (art. 20); the contract contents come from the 2011 Regulation and good practice.
  • As good practice, prohibit the vendor from using the data to train its own models unless expressly authorized.
Typical evidence
  • Signed data processing agreements or addenda with each AI vendor.
  • List of vendors that handle personal data.
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Checked in the DOF that the 2025 law defines the processor (art. 2, sec. XII) and requires confidentiality from everyone involved in processing (art. 20), but it does not regulate the processor contract. Whether the 2011 Regulation, which does, still applies until a new one is issued remains unconfirmed.

Data transfers to third parties and other countries

LFPDPPP 2025, arts. 2, fr. XX, 35 y 36In force

Applies from March 21, 2025

When it relates
If you send personal data to third parties or to vendors outside Mexico, such as cloud AI services.
What the rule provides
  • Distinguish sending data to a processor acting on your company's behalf from a transfer to a third party (art. 2, sec. XX); the 2025 law does not use the term "remission".
  • Give the recipient the privacy notice and purposes, and state in the notice whether the person accepts the transfer (art. 35).
  • Obtain consent for transfers that do not fall under the art. 36 exceptions.
  • As good practice, document recipient, country, purpose and legal basis for each data flow.
Typical evidence
  • File of cross-border data flows per vendor.
Verification
Verified in the official source on November 4, 2026Checked against the statute text published in the DOF (Decree of Mar 20, 2025, article three): art. 2, sec. XX (definition of transfer, separate from sending data to the processor), art. 35 (notice and acceptance clause) and art. 36 (exceptions to consent). In force since Mar 21, 2025 (first transitional article).

Security measures and breach notices

LFPDPPP 2025, arts. 18 y 19In force

Applies from March 21, 2025

When it relates
If you process personal data, including data that goes into or comes out of AI systems.
What the rule provides
  • Apply administrative, technical and physical safeguards proportionate to risk.
  • Inform affected individuals immediately when a breach significantly affects their property or moral rights.
  • As good practice, log breaches and the actions taken; the 2025 law does not expressly require it.
Typical evidence
  • Tested incident response plan.
  • Breach log.
Verification
Verified in the official source on November 4, 2026Checked against the statute text published in the DOF (Decree of Mar 20, 2025, article three): art. 18 (administrative, technical and physical safeguards based on risk) and art. 19 (inform individuals "immediately"). The breach log is good practice. In force since Mar 21, 2025 (first transitional article).

Handle access, correction, deletion and objection (ARCO) requests

LFPDPPP 2025, arts. 21 a 34In force

Applies from March 21, 2025

When it relates
If you process personal data of customers, employees or users.
What the rule provides
  • Have a procedure to receive and answer ARCO requests, including about data used by AI systems: reply within 20 days and act on it within the next 15 (art. 31).
  • Let people object to automated processing without human involvement that has unwanted legal effects on them or significantly affects their interests (art. 26, sec. II), and document how those decisions are reviewed.
  • Note that objection does not apply when processing is needed to meet a legal obligation (art. 26).
Typical evidence
  • Log of requests and responses.
Verification
Verified in the official source on November 4, 2026Checked against the statute text published in the DOF (Decree of Mar 20, 2025, article three): arts. 21-34; art. 26, sec. II (objection to automated processing) and last paragraph (not available for legal obligations); art. 31 (20- and 15-day deadlines). In force since Mar 21, 2025 (first transitional article).

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)