Mexico LFPDPPP — Federal Law on the Protection of Personal Data Held by Private Parties (2025)

Why does it matter?

The 2025 law is the instrument every private company handling personal data in Mexico answers to. It applies to private individuals and legal entities that process personal data (article 2, section XVI), except credit information companies under their own law and individuals who keep data for exclusively personal use without disclosure or commercial use (article 1). The Secretaría verifies compliance, on its own initiative in the cases of article 54, and fines up to 320,000 times the Unidad de Medida y Actualización (UMA), with amounts that can double for sensitive data (article 59). Chapter XII also defines offenses punished with prison of three months to five years, doubled for sensitive data (articles 62 to 64).

Key benefits include:

• Eight named principles

Article 5 requires lawfulness, purpose, loyalty, consent, quality, proportionality, information and accountability, and articles 6 to 14 define them.

• A privacy notice with required content

Article 15 lists six items: the controller's identity and address, the data processed, the purposes, options to limit use, the ARCO procedure, and how changes are communicated.

• Consent rules by data type

Consent may be express or tacit and tacit is valid as a general rule (article 7); financial or asset data needs express consent, and sensitive data needs express written consent (article 8).

• Statutory ARCO deadlines

The controller answers within 20 business days and acts within 15 more (article 31), and the first response can be extended once for an equal period.

• A rights-protection procedure

The data subject can ask the Secretaría to intervene within 15 days of the response (article 40), and it decides within 50 days (article 42).

How does it work?

The responsable (controller) must have a privacy notice available when it collects data: in person on printed forms, or in a simplified form that points to the full notice when data is collected electronically (article 16). Data is processed only for the purposes in the notice, and a new purpose needs new consent (article 11). The controller keeps data accurate, deletes it after blocking once the retention period ends (article 10) and must delete data about contractual non-compliance 72 months after the breach occurs.

The controller sets administrative, technical and physical security measures at least as strong as it applies to its own information (article 18), informs data subjects immediately of breaches that significantly affect their property or moral rights (article 19), and requires confidentiality from everyone involved (article 20). A person or department must handle data subject requests (article 29). The Secretaría hears protection requests, verifies compliance and imposes sanctions (articles 39, 40, 54 and 56 to 60), and a party can challenge its resolutions in amparo before specialized courts (article 51).

Key Elements

• Principles (article 5)

Lawfulness, purpose, loyalty, consent, quality, proportionality, information and accountability.

• Privacy notice (articles 14 to 17)

Integral and simplified versions; compensatory measures where direct notice is impossible or disproportionate (article 17).

• Consent (articles 7 to 9)

Tacit consent as the general rule, express for financial data, express and written for sensitive data, revocable at any time without retroactive effect; article 9 lists exceptions.

• ARCO rights (articles 21 to 34)

Access, rectification, cancellation with a blocking period, and opposition, including to automated processing without human intervention (article 26, section II); free of charge except reproduction and shipping costs.

• Transfers (articles 35 and 36)

The notice must carry a clause on whether the data subject accepts transfers, and the recipient assumes the controller's obligations; article 36 lists transfers allowed without consent.

• Authority and sanctions (articles 38 to 64)

The Secretaría supervises and sanctions; infringements are listed in article 58 and penalties in article 59.

What does it cover?

The law applies throughout the national territory (article 1) to private individuals and private legal entities that process personal data, called sujetos regulados (article 2, section XVI). It does not apply to credit information companies in the cases covered by their own law, or to individuals who collect and store personal data for exclusively personal use without disclosure or commercial use (article 1). Public bodies fall under the separate Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados. The principles and rights are limited by the protection of national security, public order, public safety and health, and the rights of third parties (article 3).

What are its objectives?

Article 1 states the law's object: the legitimate, controlled and informed processing of personal data, to guarantee privacy and informational self-determination.

Regulate legitimate, controlled and informed processing of personal data held by private parties.

Guarantee privacy and the right to informational self-determination.

Give data subjects ARCO rights and a procedure before the Secretaría to enforce them.

Require controllers to document notices, consent, security measures and transfers.

Deter infringements through fines in UMA (article 59), criminal offenses (articles 62 to 64) and damages claims under other laws (article 53).

Framework in Context

The 2025 law keeps the same eight principles, the privacy notice and the ARCO rights, but it changes the supervising authority, the article numbering and several provisions, so references to the 2010 law's articles need updating. The Reglamento of December 21, 2011 is still published as current text on the Chamber of Deputies site, and the 2025 law refers to a Reglamento (article 2, section XIII), but the 2025 decree has no transitional rule that preserves it and the Reglamento cites the 2010 law's numbering, so check each reference before relying on it. Mexico's constitution protects ARCO rights in article 16, which article 58 section XVII cites.

Common Framework Mappings

Organizations map the LFPDPPP to the privacy laws and standards they already operate under so that notices, consent, rights and security controls are managed once.

Mapped frameworks include:

APEC PF

LGPD

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines