Mexico

The new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published 20 March 2025, states in article 1 only that it is 'de orden publico y de observancia general en todo el territorio nacional'. Unlike the European Union's General Data Protection Regulation it contains no targeting or monitoring test. The extraterritorial hook sat in article 4 of the 2011 Reglamento to the repealed 2010 law, which applied the regime where processing was carried out by a controller with an establishment in Mexico, by a processor acting for such a controller, or by a controller with no Mexican establishment that used 'medios situados en dicho territorio'. That article also permitted appointment of a representative rather than an establishment. The 2011 Reglamento has not been replaced and the law it regulated was abrogated by transitory article Segundo of the March 2025 decree. Two exclusions survive in article 1: credit bureaux (regulated separately) and purely personal, non-commercial data collection.

Articles 35 and 36 LFPDPPP. Article 35 requires the controller to pass the privacy notice and the purposes to the recipient, and requires the privacy notice to carry a clause by which the data subject accepts or refuses the transfer; the recipient assumes the same obligations as the transferor. Article 36 lists seven cases where no consent is needed: transfer required by a law or treaty; medical diagnosis, healthcare or health-service management; transfer to a holding company, subsidiary or affiliate under common control operating under the same internal policies; transfer necessary under a contract in the data subject's interest; safeguarding a public interest or the administration of justice; establishing, exercising or defending a right in judicial proceedings; and maintaining or performing a legal relationship with the data subject. Critically, the law draws the same line for domestic and international transfers - the word 'internacionales' triggers no additional requirement anywhere in the statute. Transmission to an 'encargado' (processor) is a 'remision', not a transfer, and is carved out of article 35. Sector overrides found: (1) BANKING - data can leave with the right paperwork. Article 328 of the CNBV banking rulebook requires the bank to obtain the Commission's authorisation, in every case, before contracting any operational process or database administration performed wholly or partly outside Mexico or by a non-resident, applying at least twenty business days ahead, and to satisfy a destination-country test and keep audit documentation in its Mexican head office. (2) SECURITIES - data can leave with the right paperwork. Article 206 Bis 2 of the brokerage rulebook imposes the same destination test and Mexican-head-office requirement but by twenty-business-day prior notice rather than authorisation. (3) FINTECH / CROWDFUNDING - a copy must stay in the country. Articles 85 and 86 of the fintech rulebook require CNBV authorisation and, separately, that the institution keep detailed records of every operation and its daily closing accounting records on its own premises, usable even when the outsourced service is unavailable. (4) INSURANCE - data can leave with the right paperwork; article 268 of the insurance law empowers the insurance regulator to designate outsourcing that needs prior authorisation, and to order suspension of the service. (5) TELECOMS - a copy must stay in the country in practice; article 183 of the 2025 telecoms law requires twenty-four months of communications records to be held in systems that allow real-time query and delivery to Mexican authorities, with a twenty-four-hour delivery deadline and a unit staffed around the clock. Two cross-cutting rules bite regardless of sector: the anti-money-laundering law requires ten years of records at an address registered with the Finance Ministry, and the Federal Tax Code requires supporting accounting documentation to be available at the taxpayer's Mexican fiscal domicile for five years. Checked on 18 August 2026: we found no localisation rule for health data, education, gaming, e-commerce or mapping and geospatial data. The statistics and geography law protects data given to the national statistics institute but imposes no storage-location duty on private companies.

There is no adequacy mechanism, no standard contractual clauses published by any Mexican authority, no binding corporate rules approval route and no registration of transfers. Article 37 LFPDPPP allows voluntary self-regulation schemes (codes of practice, trust seals) notified to the authority, but these complement the law rather than unlock transfers. The practical instrument is therefore the aviso de privacidad plus, in most cases, a data processing agreement driven by article 20 (confidentiality controls binding everyone involved in processing) and article 35 (the recipient assumes the transferor's obligations). Where the recipient is a group company under common control operating under the same internal policies, article 36 fraction III removes the consent requirement entirely, which is why intra-group transfers are the easy case in Mexico. In the financial sector the picture inverts: the CNBV performs a destination-country assessment that functions like an adequacy test, requiring evidence that the provider resides in a country whose domestic law protects personal data, or that has an international agreement with Mexico on data protection or on information exchange between supervisors.

The decree of 20 March 2025 abrogated the 2010 privacy law and extinguished the Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales (INAI). Transitory articles Quinto and Decimo Tercero moved INAI's staff and case files to the Secretaría Anticorrupción y Buen Gobierno, which operates the transparency function under the banner 'Transparencia para el Pueblo'. Articles 38 and 39 LFPDPPP give that ministry the objects and powers of the regulator; articles 40 to 57 set out the rights-protection, verification and sanction procedures, but each of those chapters expressly defers the form, terms and time limits to 'el Reglamento'. Transitory article Decimo Segundo required the Executive to issue the corresponding regulatory adjustments within ninety calendar days of entry into force, that is by approximately 18 June 2025. As at 18 August 2026 the official federal regulations index still lists only the 2011 Reglamento made under the repealed law. We could not evidence any published private-sector sanction decision under the new law from an official source. We therefore rate enforcement as waking rather than active: the powers exist and the obligations are live, but the machinery is unproven and the regulator is no longer independent. Sectoral enforcement is a different story. The banking regulator's rulebook has been amended by resolutions published in the official gazette on 26 and 27 March, 18 May, 5 and 12 June and 1, 2, 3 and 14 July 2026, which is direct evidence of an active supervisor. The telecoms regulator changed identity during the period: the Instituto Federal de Telecomunicaciones now serves only as a historical archive and directs all live business to the Comisión Reguladora de Telecomunicaciones, confirming that the new commission's board has been constituted and that the 2014 telecoms law has been abrogated.

CEILINGS. Article 10 LFPDPPP: once data are no longer necessary for the purposes in the privacy notice they must be deleted after blocking, once the retention period ends. Article 10 also contains a rare absolute ceiling - data about breach of contractual obligations must be erased after seventy-two months from the date of the default. Article 24: cancellation triggers a blocking period equal to the limitation period for actions arising from the underlying legal relationship, after which the data are suppressed; the controller may keep them only for liabilities arising from the processing. Article 12 requires a specific effort to minimise the processing period for sensitive data. FLOORS. Federal Tax Code article 30: accounting and related documentation must be kept five years from the date the related return was or should have been filed, extended for the life of the company for incorporation deeds, capital changes, mergers, demergers and dividend records. Article 28 fraction III adds the location duty - the supporting documentation must be available at the taxpayer's fiscal domicile. Anti-money-laundering law articles 15 fraction IV and 18 fraction IV: at least ten years, and article 18 requires it to be kept physically or electronically 'en el domicilio registrado ante la Secretaria para este efecto'; the ten-year figure and the domicile wording were both set by the reform published 16 July 2025. Telecommunications law article 183 fraction II: twenty-four months, split as twelve months in systems allowing real-time query and twelve further months in electronic archive with a forty-eight-hour retrieval deadline. CONFLICT RESOLUTION. Article 36 fraction I and the general architecture of the law treat processing required by another law as lawful, so a statutory floor overrides the deletion duty for as long as the floor runs.

GENERAL LAW. Article 19 LFPDPPP: security breaches at any stage of processing that significantly affect the data subject's patrimonial or moral rights must be reported to the data subject 'de forma inmediata' so they can defend themselves. There is no stated hour count, no regulator notification duty, and no risk-threshold test beyond significance. This is materially lighter than the European Union's seventy-two-hour regulator notification. BANKING. Article 168 Bis 17 area of the CNBV banking rulebook: the chief executive must ensure information-security incidents are reported to the Commission immediately by email to a dedicated cybersecurity address with a timestamped acknowledgement, stating start time, whether it is ongoing, a description and an initial impact assessment. Reportable incidents are those causing economic loss, loss of information or service interruption; those whose method could be replicated at other institutions; those that could affect customers, the stability of the financial or payments system, central payment systems, their service providers, clearing houses or securities depositories; or any the institution considers serious. A full report following annexes 64 and 64 Bis is due within five business days of identification, and a remediation plan within fifteen business days of the incident concluding. Where sensitive information in the custody of the bank or its service providers was extracted, lost, deleted or altered, or unauthorised access is suspected, customers must be notified within forty-eight hours of the incident or of becoming aware of it. TELECOMS. Article 183 fractions III and IV of the 2025 telecoms law: conserved data must be handed to designated authorities within a maximum of twenty-four hours of notification, and the operator must maintain an area available twenty-four hours a day, three hundred and sixty-five days a year. The overlap that catches people is the banking one: forty-eight hours to customers is far shorter than the practical reading of 'immediately' most companies apply under the general law, and the five-business-day regulator report is easy to miss while incident response is still running.

1. THE POPULATION ID DUTY. The Ley General de Poblacion was amended on 16 July 2025 to make the Clave Unica de Registro de Poblacion (CURP) containing fingerprints and a photograph the compulsory national identity document. Article 91 Sexies states that 'todo ente publico o particular estara obligado a solicitar la Clave Unica de Registro de Poblacion para la prestacion de sus tramites y servicios', and transitory article Cuarto gave all public and private entities ninety calendar days from entry into force - roughly 15 October 2025 - to build the CURP into their processes. A statutory duty on every private company to collect a government identifier from every customer sits awkwardly against the privacy law's own minimisation principle in article 12, and nothing in either text resolves the tension. 2. TEN YEARS AT A MEXICAN ADDRESS. Article 18 fraction IV of the anti-money-laundering law requires records supporting a 'vulnerable activity' to be kept, physically or electronically, at the address registered with the Finance Ministry, for at least ten years. Vulnerable activities reach far beyond banks - real estate, vehicle dealers, jewellers, professional services, virtual asset providers and others. This is a storage-location duty hiding in a financial crime statute rather than in the privacy law, and most privacy programmes never look at it. 3. PRISON, NOT JUST FINES. Articles 62 to 64 LFPDPPP create criminal offences. Causing a security breach to a database in your custody, for profit, while authorised to process the data, carries three months to three years in prison. Processing data by deception for improper gain carries six months to five years. Where sensitive data are involved, both penalties double. These attach to individuals and sit alongside, not instead of, administrative fines and civil liability. 4. BANKING PERMISSION FOR ORDINARY CLOUD. Article 328 of the banking rulebook is not limited to material outsourcing. It applies 'en todo momento, con independencia de que los procesos de que se trate puedan o no afectar cualitativa o cuantitativamente' the bank's operations. Any operational process or database administration performed even partly outside Mexico needs the Commission's authorisation, applied for at least twenty business days ahead, with board or audit-committee approval on record covering geographic distance and language risk. Article 328 fraction II also requires the bank to keep evaluations, audit results and performance reports in its principal offices in Mexico and to produce them in Spanish on demand. 5. THE MISSING RULEBOOK. The 2025 law defers the procedure for rights complaints, verification and sanctions to a Reglamento that has not been issued, more than fourteen months after the ninety-day deadline in transitory article Decimo Segundo. Meanwhile the only published Reglamento regulates a law that no longer exists. Practitioners cannot safely rely on the 2011 text and have nothing else. 6. HONOURABLE MENTION - children. Unlike India or the United States, the Mexican privacy law sets no specific age threshold and no parental consent mechanism for children. That is a gap rather than a protection, and it means general civil-law capacity rules apply.

EXPECTED WITHIN TWELVE MONTHS. 1. The Reglamento to the 2025 privacy law. Transitory article Decimo Segundo required it within ninety calendar days of 21 March 2025. It is over fourteen months overdue. It will define the sanction procedure, the verification procedure and the rights-protection procedure, and it is the single change most likely to shift Mexico's enforcement rating. 2. Continued rollout of the biometric CURP and the Plataforma Unica de Identidad. The platform was to be built within ninety days of 17 July 2025 and the biometric enrolment programme for children within one hundred and twenty days. Linkage to the national health register follows when that register starts operating. 3. Telehealth. Articles 71 Quinquies to 71 Septies were added to the General Health Law by the reform published 15 January 2026, requiring secure systems, informed consent and proper record-keeping for remote care. Secondary Mexican Official Standards are the natural next step. DORMANT SWITCHES - powers already held that could change the picture without warning. A. The banking regulator can add or tighten conditions in article 328 of its rulebook by a single resolution in the official gazette, as it did nine times between March and July 2026. A change there would immediately affect every bank's cloud arrangements. B. The insurance law, article 268 fraction IV, already empowers the insurance regulator to designate which outsourcing needs prior authorisation, and the final paragraph lets it order partial or total, temporary or definitive suspension of a service provided through a third party. Neither requires new legislation. C. The telecoms law lets the Telecommunications Regulatory Commission designate which authorised operators, beyond concession holders, are caught by the twenty-four-month retention and real-time geolocation duties in article 183. That designation is an administrative act. D. Because enforcement now sits inside a ministry rather than an independent institute, the intensity of privacy enforcement is a policy choice of the executive rather than of an autonomous body. We found no pending bill that would introduce a general data localisation requirement, checked 18 August 2026.