Mexico
ComprehensiveFederal Law on Protection of Personal Data (LFPDPPP)
Authority: INAI | Enforcement: Active | Enacted: July 2010
Overview
Mexico has had comprehensive data protection since 2010 for private sector (LFPDPPP) and 2017 for public sector. INAI is the autonomous regulator. The framework is GDPR-aligned and provides robust data subject rights.
14-Topic Coverage
Data Protection Authority
Fully AddressedINAI is an autonomous constitutional body overseeing both privacy and transparency.
Consent Requirements
Fully AddressedExpress consent for sensitive data, tacit consent for general data. Privacy Notice mandatory.
Data Subject Rights
Fully AddressedARCO rights: Access, Rectification, Cancellation, and Opposition.
Cross-Border Transfer
Fully AddressedConsent or contractual safeguards required. Privacy Notice must disclose transfers.
Breach Notification
Fully AddressedMust notify affected individuals when breach significantly affects their rights.
DPO Requirements
Partially AddressedMust designate department/person for privacy requests. Not formally called DPO.
Children's Data
Partially AddressedParental consent required for children. No specific age threshold in law.
Penalties & Enforcement
Fully AddressedFines up to approximately USD 1.6 million. Active enforcement by INAI.
Sector-Specific Rules
Fully AddressedCNBV financial rules, health data regulations, telecom sector requirements.
Cookie/Tracking
Partially AddressedPrivacy Notice must cover cookies. No specific cookie consent law.
AI & Automated Decisions
Not AddressedNo specific AI or automated decision provisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Fully AddressedSeparate General Law on Personal Data Protection in Possession of Obligated Subjects (2017).
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Mexico's regulations.
Book a Consultation