Countries › Mexico › Guide › 13. Regulation › Personal data protection in Mexico: the 2025 private sector data law, privacy notices, consent, ARCO rights, transfers abroad and fines

Personal data protection in Mexico: the 2025 private sector data law, privacy notices, consent, ARCO rights, transfers abroad and fines

Last verified: 2026-10-26 · Status: Changing

Since 21 March 2025 private companies that process personal data in Mexico follow a new Federal Law on Protection of Personal Data Held by Private Parties, supervised by the Ministry of Anticorruption and Good Government after the abolition of INAI. Every controller needs a privacy notice with six minimum elements, consent (tacit by default, express for financial data, express and written for sensitive data), security measures and a procedure to answer access, rectification, cancellation and objection (ARCO) requests within 20 business days. Transfers to third parties in Mexico or abroad require sharing the privacy notice, but no consent is needed for intra group transfers under common policies or transfers needed for a contract; fines reach 320,000 UMA, doubled for sensitive data, and some misuse is a crime.

USD conversions use MXN 18.6638 per US dollar, the US Federal Reserve H.10 noon buying rate in New York for 23 October 2026 (FRED series DEXMXUS), the latest observation available when this page was verified. Peso amounts set in UMA use the 2026 daily UMA of MXN 117.31, in force since 1 February 2026 (INEGI publication in the DOF of 9 January 2026, as cited in IMSS Technical Council agreement ACDO.AS2.HCT.270126/9.P.DIR). Conversions are for orientation only.

Key facts

Term to make an accepted ARCO request effective after the answer	15 business daysLFPDPPP art. 31, as of 2026-10-26 · in force
Maximum term for the Ministry to resolve a rights protection request	50 business daysLFPDPPP art. 42, as of 2026-10-26 · in force
Maximum fine, lower band infringements	160000 UMALFPDPPP art. 59, section II, as of 2026-10-26 · in force
Maximum fine, upper band infringements (320,000 UMA, 2026)	37539200.00 MXNLFPDPPP art. 59, section III, as of 2026-10-26 · in force
Maximum multiplier of fines for infringements involving sensitive data	2 timesLFPDPPP art. 59, section IV, as of 2026-10-26 · in force
Maximum retention of data on breach of contractual obligations	72 monthsLFPDPPP art. 10, as of 2026-10-26 · in force
Maximum prison term for deceptive processing for profit (doubled for sensitive data)	5 yearsLFPDPPP arts. 63 and 64, as of 2026-10-26 · in force

The rule

1. Scope and regulator. The law applies to private individuals and companies that process personal data, meaning any information about an identified or identifiable person, in any form. It excludes credit bureaus acting under their own law and purely personal, non commercial collections. The authority is the Ministry of Anticorruption and Good Government (Secretaría Anticorrupción y Buen Gobierno), which handles rights protection procedures, verifications and sanctions. The new law of DOF 20 March 2025 entered into force the next day and abrogated the 2010 law; INAI's functions on personal data passed to the Ministry. Days in the law are business days.
Cost to do it: No registration, filing or license fee for private controllers. Compliance cost is legal drafting of notices and internal policies and IT security work.
Example: A US SaaS provider that collects names and emails of Mexican business users through a Mexican subsidiary is a controller under the law. / No fee in MXN or USD; the main cost is counsel and security measures.Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), new law DOF 20 March 2025, last reform DOF 14 November 2025, Arts. 1, 2 (sections V, VIII, XV and XVI), 38 and 39; transitory articles First, Second and Fourth, 2025-03-20 official text · verified 2026-10-26 · changed: New law DOF 20 March 2025 (in force 21 March 2025) replaced the law of DOF 5 July 2010 and moved supervision from INAI to the Ministry of Anticorruption and Good Government.

2. Privacy notice and consent. The controller must inform data subjects through a privacy notice, made available from the moment data are collected, containing at least (I) its identity and address; (II) the data processed, identifying sensitive data; (III) the purposes, separating those that require consent; (IV) options to limit use or disclosure; (V) the means to exercise ARCO rights; and (VI) how changes to the notice will be communicated. All processing requires consent unless an exception applies. Consent is tacit when the notice was made available and the data subject did not object, and tacit consent is the general rule; financial or property data require express consent; sensitive data (health, genetic, racial or ethnic origin, religious, philosophical and moral beliefs, political opinions, sexual preference) require express written consent by handwritten or electronic signature or another authentication mechanism, and databases of sensitive data may only be created for legitimate, concrete purposes. Consent is not needed, among other cases, when a law requires the processing, for data from public sources, for disassociated data, to perform a legal relationship with the data subject, in emergencies, or by court order.
Cost to do it: Drafting a compliant privacy notice and consent flows is a one off legal cost; collecting signed consent for sensitive data adds process cost (for example in HR and health services).
Example: An employer that runs pre employment medical checks needs the candidate's express written consent for the health data, while ordinary contact data can rely on tacit consent through the privacy notice. / A fintech app that collects bank account data needs express consent because they are financial data (art. 7).Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Arts. 2, sections I and VI, 7, 8, 9, 14 and 15, 2025-03-20 official text · verified 2026-10-26

3. ARCO rights and response times. Data subjects may request access, rectification, cancellation or objection (ARCO). The controller must answer within a maximum of 20 business days from receipt and, if the request is granted, make it effective within the following 15 business days; both terms may be extended once for an equal period when justified. Exercising ARCO rights is free, except reproduction or shipping costs, and repeat requests within 12 months may cost no more than three UMA unless the notice changed substantially. Controllers may refuse only on listed grounds (identity not proven, data not held, harm to third parties, legal impediment, already done). Data on breach of contractual obligations must be deleted 72 months after the breach. If the controller does not answer or the data subject disagrees, the data subject may file a rights protection request with the Ministry within 15 business days of the answer; the Ministry must resolve within 50 business days, extendable once.
Cost to do it: Repeat request charge cap: 3 UMA, MXN 351.93 (about USD 18.86) in 2026. Internal cost is a staffed ARCO channel.
Example: A customer asks on 2 March to cancel their data: the controller must answer within 20 business days and, if it agrees, delete within 15 more business days, unless an exception in art. 25 applies (for example the data are needed to perform a contract or required by tax law). / Outside the free cases, a repeat requester within 12 months can be charged no more than about USD 18.86.Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Arts. 10, 21 to 34, 40 and 42, 2025-03-20 official text · verified 2026-10-26

4. Security and breaches. Controllers must keep administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized use, access or processing, no weaker than those used for their own information and proportionate to risk, sensitivity and technology. Breaches at any stage that significantly affect data subjects' property or moral rights must be reported to them immediately so they can protect themselves. Everyone involved in processing must keep confidentiality, even after the relationship ends.
Cost to do it: Security program cost depends on the business; the law does not set a certification requirement.
Example: After a ransomware attack exposing client card data, a retailer must notify affected clients immediately; failing to keep security measures is an infringement in the upper fine band. / Breach of security imputable to the controller (art. 58, section XI) is fined from 200 up to 320,000 UMA, about USD 1,257 up to USD 2.01 million.Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Arts. 18, 19 and 20, 2025-03-20 official text · verified 2026-10-26

5. Transfers in Mexico and abroad. To transfer data to third parties in Mexico or abroad (other than a processor), the controller must give them the privacy notice and the purposes the data subject accepted; the notice must include a clause on whether the data subject accepts the transfer, and the recipient assumes the same obligations as the controller. Consent is not required when the transfer is provided for in a law or treaty to which Mexico is a party; needed for medical care; made to controlling, subsidiary or affiliated companies under common control, or to a parent or group company operating under the same internal processes and policies; needed for a contract concluded or to be concluded in the data subject's interest; needed for public interest or justice; needed to exercise or defend a right in court; or needed to maintain a legal relationship with the data subject. The law has no adequacy list and no prior authorization for international transfers.
Cost to do it: Intra group data transfer agreements and common group policies are the usual tool; drafting cost only.
Example: A Mexican subsidiary may send payroll data to its US parent's HR system without new employee consent if both operate under the same internal processes and policies, but must still give the parent its privacy notice. / Sending customer data to an unrelated US marketing agency acting on its own behalf is a transfer that needs the notice clause and, unless an exception applies, consent.Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Arts. 2, section XX, 35 and 36, 2025-03-20 official text · verified 2026-10-26

6. Sanctions and crimes. Infringements include ignoring ARCO requests, processing against the principles, omitting notice elements, breaching confidentiality, changing purposes, transferring without the notice or outside permitted cases, security breaches imputable to the controller, collecting or transferring without required express consent, obstructing verifications and deceptive collection. The Ministry may issue a warning for unanswered ARCO requests; fines run from 100 to 160,000 UMA for the lower band (art. 58, sections II to VII) and from 200 to 320,000 UMA for the upper band (sections VIII to XVIII); persistent infringements add a fine of 100 to 320,000 UMA, and amounts can be doubled for sensitive data. Fines consider the nature of the data, intent, economic capacity and repeat offences. Prison of three months to three years applies to an authorized processor who causes a security breach for profit, and six months to five years to whoever processes data through deception for undue profit; both are doubled for sensitive data. Data subjects may also claim damages, and Ministry resolutions can be challenged through amparo before specialized courts.
Cost to do it: Lower band: MXN 11,731 to MXN 18,769,600; upper band: MXN 23,462 to MXN 37,539,200 (about USD 1,257 to USD 2.01 million); up to MXN 75,078,400 if doubled for sensitive data.
Example: A clinic that transfers patient records to a lab without the required express consent risks an upper band fine of up to MXN 37,539,200, doubled to MXN 75,078,400 because health data are sensitive. / About USD 2.01 million, or about USD 4.02 million when doubled.Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Arts. 51, 53, 58 to 64, 2025-03-20 official text · verified 2026-10-26

Type of data	Consent required	Article
Ordinary personal data	Tacit consent through the privacy notice is valid unless a rule requires express consent	Art. 7
Financial or property data	Express consent, except arts. 9 and 36 cases	Art. 7
Sensitive data	Express and written consent (handwritten or electronic signature or other authentication)	Art. 8
Exceptions	Legal obligation, public sources, disassociated data, legal relationship, emergency, health care, court order	Art. 9

Consent levels under the LFPDPPP of 2025

Band	Infringements (art. 58)	UMA	MXN 2026	About USD
Warning	I. Not answering ARCO requests without reason
Lower	II to VII. Negligent ARCO handling, notice omissions, processing against principles, inaccurate data	100 to 160,000	MXN 11,731 to MXN 18,769,600	USD 629 to USD 1.01 million
Upper	VIII to XVIII. Confidentiality, purpose change, unlawful transfers, security breaches, no express consent, obstruction, deception	200 to 320,000	MXN 23,462 to MXN 37,539,200	USD 1,257 to USD 2.01 million
Repeat	Persistent infringements, additional fine	100 to 320,000	MXN 11,731 to MXN 37,539,200	USD 629 to USD 2.01 million

Fines under LFPDPPP art. 59 in 2026 (UMA MXN 117.31; USD at MXN 18.6638)

Worked example

A European e commerce group opens a Mexican subsidiary that will collect customer data and process it on group servers in Ireland. The subsidiary publishes a privacy notice with the six elements of art. 15, relies on tacit consent for order data, asks express consent for stored card and bank data (art. 7) and sets up an ARCO mailbox with a 20 business day answer workflow (art. 31).
The transfer to the group in Ireland needs no new consent if both entities operate under the same internal processes and policies (art. 36, section III), but the subsidiary must give the parent its privacy notice (art. 35). If a later breach is caused by missing security measures, the exposure is up to 320,000 UMA, MXN 37,539,200 or about USD 2.01 million.

Step by step

1. Inventory personal data by category, flagging financial and sensitive data, and the purposes of each processing.
2. Publish a privacy notice with the six elements of art. 15 at every collection point (web, app, HR, call center).
3. Collect express consent for financial data and express written consent for sensitive data; keep evidence.
4. Set up an ARCO procedure: identity checks, 20 business day answer, 15 business day execution, logs.
5. Adopt intra group data policies so transfers fit art. 36, section III; for third parties, add the transfer clause in the notice and pass the notice to recipients.
6. Document administrative, technical and physical security measures and a breach response plan with immediate notice to affected people (arts. 18 and 19).

Common traps

Relying on INAI guidance or the 2010 law: the 2025 law replaced both, and the regulator is now the Ministry of Anticorruption and Good Government (LFPDPPP transitory articles Second and Fourth).
Treating all consent as tacit: financial data need express consent and sensitive data express written consent (arts. 7 and 8).
Assuming intra group transfers are always free: the exception covers group companies under common control operating under the same internal processes and policies, and the recipient still takes on the controller's duties (arts. 35 and 36).
Keeping debt default data forever: it must be deleted 72 months after the breach (art. 10).
Counting the ARCO term in calendar days: days in the law are business days (art. 2, section VIII), but missing the 20 day answer is still the most common trigger for a protection request (arts. 31 and 40).
Citing the 2011 regulation without checking: the regulation consolidated by the Chamber of Deputies is dated DOF 21 December 2011 and was issued under the abrogated 2010 law, so provisions must be read against the new law.

Sources

← Antitrust conduct in Mexico: cartels, abuse of dominance, dawn raids, leniency and fines under the Federal Economic Competition LawAnti money laundering in Mexico for non financial businesses: vulnerable activities, client identification, monthly notices, cash bans and fines →