Mexico. Comprehensive data protection. Law
LFPDPPP 2025Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, 2025)
§1Summary
- Synopsis
New private-sector data protection law replacing the 2010 statute following the dissolution of the INAI. It keeps the ARCO rights and privacy notice model, adds processor coverage, retention concepts and a right to object to significant automated processing, with oversight by a government ministry.
- Key themes
- Unique features
Supervision moved from an autonomous constitutional body (INAI) to a federal ministry (SABG), raising independence concerns; privacy notices no longer need to list transfers.
- SaaS relevance
Applies to private parties processing personal data in Mexico; SaaS processors now expressly covered and must keep confidentiality and follow controller instructions.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Data subjects promptly where breach significantly affects rights (no authority notification duty)
- DPO
- Yes
- Cross-border transfers
- Transfers per privacy notice/consent; processors (remissions) without consent
- Maximum penalty
- Fines indexed to UMA (up to 320,000 UMA, doubled for sensitive data); imprisonment up to 5 years (10 for sensitive)
§3Dates
- Key dates
- Adopted
- In force
- Published DOF 2025-03-20, repealing the 2010 law; INAI extinguished and powers transferred to SABG; 2011 Regulations remain applicable pending new ones
§4Text and authority
- Text
- Authoritative text diputados.gob.mx
- Authority
- Secretaría Anticorrupción y Buen Gobierno (SABG)
§5Where it applies
- Domestic law of
- Mexico
§6Sources and verification
- Sources consulted
- Verification
High confidence.
320,000 UMA cap carried from prior law per general knowledge; verify in new text.