Federal Law on the Protection of Personal Data Held by Private Parties - Compliance Guide

· About Federal Law on the Protection of Personal Data Held by Private Parties

Key Takeaways

  • The Federal Law on the Protection of Personal Data Held by Private Parties applies nationwide to private-sector processing of personal data in Mexico, including organizations established outside Mexico when they process personal data in connection with services or activities covered by the law.[3][5]
  • The law was published on 20 March 2025 and entered into force on 21 March 2025, replacing the 2010 federal private-sector data protection statute.[1][2][6]
  • The enforcement authority shifted from the former transparency/data-protection institute to the Ministry of Anticorruption and Good Governance, which now supervises, investigates, and sanctions compliance matters.[1][2][15]
  • Controllers must provide a compliant privacy notice, obtain valid consent where required, implement security controls, and honor rights of access, rectification, cancellation, and opposition, as well as rules for automated decision-making.[1][3][15]
  • The law materially increases sanctions, with criminal and administrative exposure for unlawful processing, failure to safeguard data, or unauthorized transfers, and it is now paired with specialized judicial routes for data-protection disputes.[1][15]
  • As of early 2026, commentary indicates that implementing regulations had still not fully clarified all operational details, so organizations should treat the 2025 text as effective law while tracking subordinate rules and any 2025 reform texts.[3][9][10]

What It Is

The law is Mexico’s federal private-sector personal data statute and is a public-order, nationwide baseline for the processing of personal data by private parties.[3][5][8] It regulates the legitimate, controlled, and informed processing of personal data and is enforced by the federal executive branch through the Ministry of Anticorruption and Good Governance after the 2025 institutional reform.[1][2][15]

The current law was published on 20 March 2025 and entered into force on 21 March 2025.[1][2][6] It replaced the prior 2010 version of the Federal Law on the Protection of Personal Data Held by Private Parties.[1][6][8]

A 2025 reform package also reorganized Mexico’s broader transparency and public-sector data-protection framework, including the dissolution of INAI and transfer of functions to the new ministry.[1][2][15] Secondary sources available in 2026 indicate that regulations and operational guidance have lagged behind the statute, so companies should watch for implementing rules and any November 2025 reform text noted by the consolidated law sources.[3][9][10]

Who Must Comply

The law applies to any treatment of personal data held by private parties in Mexico.[5][8] That makes it relevant to companies, sole traders, and other private actors that collect, use, disclose, store, transfer, or otherwise process personal data in the course of their activities.[3][5]

Its reach is effectively extraterritorial where a foreign entity processes personal data in connection with Mexico-facing activities or services, because the law functions as a national baseline for private-sector processing rather than a state-by-state regime.[3] In practice, non-Mexican organizations should assess whether they target Mexican residents, contract with Mexican entities, or otherwise process data tied to Mexico.

The main statutory exemptions are the usual private-law carveouts for processing by individuals for purely personal or household purposes, and for certain data processed in contexts governed by other specific legal regimes; however, the 2025 materials available here do not indicate that the law abandoned those classic exclusions.[3][8] Because the current subordinate guidance is still developing, controllers should verify whether any sector-specific rules, journalistic exceptions, or internal-use limitations apply before relying on an exemption.[3][10]

Core Requirements

  1. Privacy notice — Controllers must provide a clear privacy notice explaining the identity of the controller, the purposes of processing, the mechanisms to exercise rights, and any transfers or sensitive-data handling that require special disclosure.[1][3]
  2. Lawful basis and consent — Processing must be legitimate and informed, with consent required in many cases unless another legal basis or exception applies; notice and consent are central compliance requirements in the Mexican framework.[3][15]
  3. Data subject rights — Controllers must support the Mexican data subject rights regime, including access, rectification, cancellation, and opposition, plus newer protections around automated processing referenced in 2025 commentary.[1][15]
  4. Security safeguards — Controllers must implement administrative, physical, and technical measures proportionate to the sensitivity and risk of the personal data processed.[1][3]
  5. Data transfers — Transfers to third parties, including cross-border disclosures, must be controlled, disclosed where required, and aligned with the law’s transfer rules and any consent requirements.[1][3]
  6. Accountability and documentation — Organizations should maintain internal policies, records, and procedures showing how they comply, because the 2025 regime places heavier emphasis on demonstrable governance and sanctions non-compliance more aggressively.[1][15]
  7. Automated decision-making controls — Where profiling or automated processing materially affects individuals, the law’s 2025 update indicates heightened transparency and rights protections.[15]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Publication in Official Gazette | 20 March 2025 | New federal private-sector data protection law published.[1][2] | | Entry into force | 21 March 2025 | New law became operative and replaced the 2010 statute.[1][2][6] | | Institutional transition | 21 March 2025 | Supervisory functions moved from INAI to the Ministry of Anticorruption and Good Governance.[1][2][15] | | 2025 reform text in consolidated sources | 14 November 2025 | Consolidated law sources show a later published reform, so compliance teams should review the current consolidated text.[9][10] |

The 2025 reform is described by practitioner sources as introducing higher fines and a more aggressive sanctions environment than the 2010 framework.[1][15] Those sources also note that enforcement can include criminal exposure, administrative sanctions, and proceedings before specialized courts, but the precise fine ranges should be taken from the current official consolidated text and implementing rules before a final risk memo is issued.[1][15]

Other sanctions can include orders to suspend or correct unlawful processing, mandatory remedial measures, and litigation exposure in constitutional or administrative proceedings.[1][15] Because the regulatory architecture was still settling in 2026, exact enforcement practice may evolve as the ministry and courts issue guidance and precedent.[3][10]

How to Comply

  1. Map processing and data flows — Build a register of systems, vendors, purposes, transfers, and retention periods, then tie each activity to the Mexican law’s requirements.
  2. Refresh privacy notices and consent flows — Rewrite notices for clarity, specificity, and transfer disclosures, and separate consent for sensitive or high-risk processing where needed.
  3. Classify data and set controls — Use an ISO 27001-style control set for access management, logging, encryption, incident response, and supplier security; that framework maps well to the law’s security duties.
  4. Operationalize rights handling — Set service-level procedures for access, correction, cancellation, and opposition requests, with identity verification, tracking, and appeal handling.
  5. Build accountability evidence — Maintain policies, records of processing, vendor clauses, risk assessments, and training logs so the organization can prove compliance.
  6. Test incident and transfer governance — Align response plans with NIST CSF 2.0 functions and validate international transfer approvals, contractual safeguards, and breach escalation.
  7. Add AI and automated-decision controls — Where profiling or automated decisions matter, implement an ISO 42001-style governance layer for purpose limitation, human oversight, model documentation, and review.
  8. Track the evolving regime — Monitor the official text, ministry guidance, and any implementing regulations or reforms because 2025–2026 sources indicate the framework is still being operationalized.[3][9][10]

Related Regulations

  • General Law on Transparency and Access to Public Information — This overlaps on transparency concepts but primarily governs public-sector access and transparency, not private-sector processing.[2]
  • General Law on the Protection of Personal Data Held by Public Sector Entities — This is the public-sector counterpart and may create parallel obligations for processors working with government bodies.[2]
  • Federal Consumer Protection Law — Marketing, notice, and unfair-practice issues can overlap where personal data is used for consumer-facing promotions or loyalty programs.
  • Federal Criminal Code — Unauthorized disclosure or unlawful conduct can create criminal exposure in addition to privacy penalties, depending on the facts.[1][15]
  • Constitutional privacy and habeas-style remedies — Privacy disputes can interact with constitutional litigation and specialized judicial review under the reformed enforcement structure.[15]

FAQ

Does the law apply to companies outside Mexico?

Yes, if a foreign company processes personal data in connection with Mexico-facing activities covered by the statute. The law is a national private-sector baseline and is not limited to companies incorporated in Mexico.[3][5]

Does every processing activity require consent?

No. Consent is central, but not every processing operation needs express consent if another recognized legal basis or statutory exception applies. The privacy notice and purpose limitation rules still apply, and sensitive-data or high-risk processing usually requires a stricter approach.[3][15]

Does the law still apply after the 2025 institutional reform?

Yes. The private-sector law remained in force after the March 2025 reform, but enforcement shifted away from INAI to the Ministry of Anticorruption and Good Governance.[1][2][15] The practical compliance focus changed more than the underlying obligation to protect personal data.

Are there new rules for automated decisions or profiling?

2025 commentary indicates stronger protections for automated processing and individual rights in that context.[15] Organizations using profiling, scoring, or automated eligibility decisions should assume higher transparency and challenge requirements until official guidance confirms the operational detail.

What are the biggest enforcement risks?

The biggest risks are unlawful processing, missing or defective privacy notices, weak security controls, and improper transfers.[1][15] Sanctions can include significant fines and other administrative or judicial consequences, so documented compliance is essential.[1][15]

Sources

Put it into practice

More compliance guides