Mexico

The new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published 20 March 2025, says in article 1 only that it is 'de orden publico y de observancia general en todo el territorio nacional'. Unlike the European Union's General Data Protection Regulation, it has no targeting or monitoring test. The rule that reached foreign companies sat in article 4 of the 2011 Reglamento, made under the 2010 law that has since been repealed. That article applied the rules in three cases: work done by a company with a business in Mexico, work done by a supplier acting for such a company, and work done by a company with no Mexican business that used 'medios situados en dicho territorio'. It also let such a company appoint a representative rather than set up an office. The 2011 Reglamento has not been replaced. The law it was made under was abolished by transitory article Segundo of the March 2025 decree. Two exclusions survive in article 1: credit bureaux, which are regulated separately, and purely personal, non-commercial data collection.

Articles 35 and 36 LFPDPPP. Article 35 makes you pass your privacy notice and the purposes on to whoever receives the data. Your privacy notice must carry a clause where the person accepts or refuses the transfer. Whoever receives the data takes on the same duties as you. Article 36 lists seven cases where you need no consent. Those are: a law or treaty requires the transfer; medical diagnosis, healthcare or health-service management; a transfer to a parent company, subsidiary or affiliate under common control that follows the same internal policies; a transfer needed under a contract in the person's interest; protecting a public interest or the administration of justice; establishing, exercising or defending a right in court; and maintaining or performing a legal relationship with the person. The important point is that the law treats domestic and international transfers the same. The word 'internacionales' triggers no extra requirement anywhere in the law. Handing data to your own supplier who only follows your instructions is a 'remision', not a transfer, and article 35 does not cover it. Industry overrides we found: (1) BANKING - data can leave only if conditions are met Article 328 of the CNBV banking rulebook makes the bank get the Commission's permission, in every case, before it contracts out any operational work or database administration done wholly or partly outside Mexico, or by a non-resident. The bank must apply at least twenty business days ahead. It must satisfy a test about the destination country and keep audit paperwork in its Mexican head office. (2) SECURITIES - data can leave only if conditions are met Article 206 Bis 2 of the brokerage rulebook sets the same destination test and the same Mexican head office requirement. But it needs twenty business days' notice rather than permission. (3) FINTECH AND CROWDFUNDING - a copy must stay in the country Articles 85 and 86 of the fintech rulebook require CNBV permission. Separately, the firm must keep detailed records of every transaction and its daily closing accounts on its own premises, usable even when the outsourced service is down. (4) INSURANCE - data can leave only if conditions are met Article 268 of the insurance law lets the insurance regulator decide which outsourcing needs permission first, and lets it order a service suspended. (5) TELECOMS - a copy must stay in the country in effect. Article 183 of the 2025 telecoms law makes operators hold twenty-four months of communications records in systems that allow real-time search and delivery to Mexican authorities. There is a twenty-four-hour delivery deadline and a unit staffed around the clock. Two rules apply whatever your industry. Anti-money-laundering law requires ten years of records at an address registered with the Finance Ministry. The Federal Tax Code requires supporting accounting documents to be available at your Mexican tax address for five years. Checked on 18 August 2026: we found no rule about where data must be stored for health data, education, gaming, e-commerce, or mapping and geospatial data. The statistics and geography law protects data given to the national statistics institute. It sets no storage-location duty on private companies.

Mexico has no official decision that a country is safe enough, no standard contract clauses published by any Mexican authority, no group-wide rules approval route and no register of transfers. Article 37 LFPDPPP allows voluntary self-regulation schemes, such as codes of practice and trust seals, notified to the authority. These sit alongside the law rather than unlocking transfers. So what you actually need is the aviso de privacidad. In most cases you also need a data protection contract. That is driven by article 20, which makes confidentiality controls bind everyone who handles the data, and by article 35, which makes the recipient take on your duties. Where the recipient is a group company under common control following the same internal policies, article 36 fraction III removes the consent requirement entirely. That is why transfers inside a group are the easy case in Mexico. In the financial sector it works the other way round. The CNBV assesses the destination country itself. It asks for evidence that the provider is based in a country whose own law protects personal data, or that has an agreement with Mexico on data protection or on information sharing between supervisors.

The decree of 20 March 2025 abolished the 2010 privacy law and wound up the Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales (INAI). Transitory articles Quinto and Decimo Tercero moved INAI's staff and case files to the Secretaría Anticorrupción y Buen Gobierno. That ministry runs the transparency function under the banner 'Transparencia para el Pueblo'. Articles 38 and 39 LFPDPPP give the ministry the regulator's role and powers. Articles 40 to 57 set out the procedures for protecting people's rights, for inspections and for fines. But each of those chapters leaves the form, terms and time limits to 'el Reglamento'. Transitory article Decimo Segundo told the Executive to issue the matching regulations within ninety calendar days of the law starting, so by about 18 June 2025. As at 18 August 2026 the official federal regulations index still lists only the 2011 Reglamento, made under the repealed law. We found no published fine against a private company under the new law from an official source. So we rate enforcement as waking rather than active. The powers exist and the duties are live. But the machinery is unproven and the regulator is no longer independent. Industry enforcement is a different story. The banking regulator's rulebook was amended by resolutions published in the official gazette on 26 and 27 March, 18 May, 5 and 12 June, and 1, 2, 3 and 14 July 2026. That is direct evidence of an active supervisor. The telecoms regulator changed identity during the period. The Instituto Federal de Telecomunicaciones is now only a historical archive and sends all live business to the Comisión Reguladora de Telecomunicaciones. That confirms the new commission's board is in place and the 2014 telecoms law has been abolished.

WHAT YOU MUST DELETE. Article 10 LFPDPPP: once you no longer need the data for the purposes in your privacy notice, you must block it and then delete it, once the retention period ends. Article 10 also sets a rare absolute limit. Data about someone breaking a contract must be erased seventy-two months after the default. Article 24: when someone asks you to cancel their data, you first block it for a period equal to the time limit for suing over the underlying relationship. After that you delete it. You may only keep it for liabilities arising from your own handling of it. Article 12 makes you take specific steps to shorten how long you keep sensitive data. WHAT YOU MUST KEEP. Federal Tax Code article 30: keep accounting and related documents for five years from the date the related return was, or should have been, filed. Keep them for the life of the company for incorporation deeds, capital changes, mergers, demergers and dividend records. Article 28 fraction III adds the location duty. The supporting documents must be available at your Mexican tax address. Anti-money-laundering law articles 15 fraction IV and 18 fraction IV: at least ten years. Article 18 says the records must be kept, on paper or electronically, 'en el domicilio registrado ante la Secretaria para este efecto'. The ten-year figure and the address wording were both set by the reform published 16 July 2025. Telecommunications law article 183 fraction II: twenty-four months. That splits into twelve months in systems allowing real-time search, and twelve further months in an electronic archive with a forty-eight-hour retrieval deadline. WHICH WINS. Article 36 fraction I and the general design of the law treat work required by another law as lawful. So a legal duty to keep records overrides the duty to delete for as long as that duty runs.

GENERAL LAW. Article 19 LFPDPPP: if a security breach at any stage significantly harms a person's money or their reputation, you must tell that person 'de forma inmediata', so they can protect themselves. There is no stated hour count. There is no duty to tell the regulator. There is no risk threshold beyond significance. This is much lighter than the European Union's seventy-two-hour regulator report. BANKING. Article 168 Bis 17 of the CNBV banking rulebook: the chief executive must make sure information-security incidents are reported to the Commission immediately, by email to a dedicated cybersecurity address, with a timestamped acknowledgement. The report must state the start time, whether it is ongoing, a description and a first assessment of the impact. You must report incidents that cause financial loss, loss of information or service interruption. You must also report incidents whose method could be repeated at other institutions. So must you report incidents that could affect customers, the stability of the financial or payments system, central payment systems, their service providers, clearing houses or securities depositories. You must also report anything else the institution considers serious. A full report following annexes 64 and 64 Bis is due within five business days of identifying the incident. A remediation plan is due within fifteen business days of the incident ending. Where sensitive information held by the bank or its suppliers was taken, lost, deleted or altered, or unauthorised access is suspected, you must tell customers within forty-eight hours of the incident, or of finding out about it. TELECOMS. Article 183 fractions III and IV of the 2025 telecoms law: retained data must reach the designated authorities within twenty-four hours of the request at the latest. The operator must keep a team available twenty-four hours a day, three hundred and sixty-five days a year. The overlap that catches people is the banking one. Forty-eight hours to customers is far shorter than most companies' reading of 'immediately' under the general law. And the five-business-day regulator report is easy to miss while you are still dealing with the incident.

1. THE POPULATION ID DUTY. The Ley General de Poblacion was amended on 16 July 2025. It made the Clave Unica de Registro de Poblacion (CURP), which now carries fingerprints and a photograph, the compulsory national identity document. Article 91 Sexies says that 'todo ente publico o particular estara obligado a solicitar la Clave Unica de Registro de Poblacion para la prestacion de sus tramites y servicios'. Transitory article Cuarto gave all public and private bodies ninety calendar days from the start date, so roughly 15 October 2025, to build the CURP into their processes. A legal duty on every private company to collect a government identifier from every customer sits awkwardly next to the privacy law's own rule in article 12 to collect as little as possible. Neither text resolves the tension. 2. TEN YEARS AT A MEXICAN ADDRESS. Article 18 fraction IV of the anti-money-laundering law makes you keep records supporting a 'vulnerable activity' for at least ten years, on paper or electronically, at the address you registered with the Finance Ministry. Vulnerable activities reach far beyond banks. They cover estate agents, vehicle dealers, jewellers, professional services, virtual asset providers and others. This is a storage-location duty hiding in a financial crime law rather than in the privacy law. Most privacy programmes never look at it. 3. PRISON, NOT JUST FINES. Articles 62 to 64 LFPDPPP create criminal offences. Causing a security breach to a database in your care, for profit, while you are authorised to handle the data, carries three months to three years in prison. Handling data by deception for improper gain carries six months to five years. Where sensitive data is involved, both penalties double. These attach to individuals. They sit alongside administrative fines and civil liability, not instead of them. 4. BANKING PERMISSION FOR ORDINARY CLOUD. Article 328 of the banking rulebook is not limited to important outsourcing. It applies 'en todo momento, con independencia de que los procesos de que se trate puedan o no afectar cualitativa o cuantitativamente' the bank's operations. Any operational work or database administration done even partly outside Mexico needs the Commission's permission. You must apply at least twenty business days ahead. The board or audit committee must have approved it on record, covering distance and language risk. Article 328 fraction II also makes the bank keep evaluations, audit results and performance reports in its main offices in Mexico, and produce them in Spanish on demand. 5. THE MISSING RULEBOOK. The 2025 law leaves the procedure for rights complaints, inspections and fines to a Reglamento that has not been issued. That is more than fourteen months after the ninety-day deadline in transitory article Decimo Segundo. Meanwhile the only published Reglamento covers a law that no longer exists. You cannot safely rely on the 2011 text, and there is nothing else. 6. WORTH KNOWING - children. Unlike India or the United States, the Mexican privacy law sets no specific age threshold and no parental consent step for children. That is a gap rather than a protection. General civil-law rules on capacity apply instead.

EXPECTED WITHIN TWELVE MONTHS. 1. The Reglamento to the 2025 privacy law. Transitory article Decimo Segundo required it within ninety calendar days of 21 March 2025. It is over fourteen months late. It will set the procedures for fines, inspections and protecting people's rights. It is the single change most likely to shift Mexico's enforcement rating. 2. Continued rollout of the biometric CURP and the Plataforma Unica de Identidad. The platform was to be built within ninety days of 17 July 2025, and the biometric enrolment programme for children within one hundred and twenty days. Linking it to the national health register follows when that register starts working. 3. Telehealth. Articles 71 Quinquies to 71 Septies were added to the General Health Law by the reform published 15 January 2026. They require secure systems, informed consent and proper record-keeping for remote care. Detailed Mexican Official Standards are the natural next step. POWERS ALREADY HELD that could change the answer without warning. A. The banking regulator can add or tighten conditions in article 328 of its rulebook with a single resolution in the official gazette. It did that nine times between March and July 2026. A change there would immediately affect every bank's cloud arrangements. B. The insurance law, article 268 fraction IV, already lets the insurance regulator decide which outsourcing needs permission first. The final paragraph lets it suspend a service provided through a third party, in part or in full, temporarily or permanently. Neither needs new legislation. C. The telecoms law lets the Telecommunications Regulatory Commission decide which authorised operators, beyond concession holders, are caught by the twenty-four-month retention and real-time location duties in article 183. That decision is an administrative act. D. Enforcement now sits inside a ministry rather than an independent institute. So how hard privacy rules are enforced is now a policy choice of the executive, not of an independent body. We found no pending bill that would require data to stay in Mexico, checked 18 August 2026.