Federal Law on the Protection of Personal Data Held by Private Parties (2025)

Mexico replaced its 2010 data protection law outright in March 2025. The new LFPDPPP keeps the ARCO rights framework (Access, Rectification, Cancellation, Opposition) and the privacy-notice regime, adds transparency duties around automated decision-making, and — the structural change — reassigns enforcement. The independent regulator INAI was dissolved; its data-protection functions transferred to the executive branch, to the Secretaria Anticorrupcion y Buen Gobierno (SABG). Territorial scope is a means/establishment test rather than a GDPR-style targeting test: it reaches private parties processing personal data in Mexican territory, controllers established in Mexico, and controllers not established in Mexico that use means located in Mexican territory (or where Mexican law applies under contract or international law) — so the trigger below is modeled on established presence only, and a foreign business with no Mexican establishment or infrastructure should get specific advice rather than assuming coverage or non-coverage. Fines run from 100 to 320,000 times the UMA, doubled for sensitive-data violations.