Mexico Has Enacted a New Statute on Personal Data Protection

On March 20, Mexico’s new Federal Law on the Protection of Personal Data Held by Private Parties (FLPPD) was published. This law took effect on March 21 and contains important changes in terms of privacy. 

First, the law eliminates the National Institute for Transparency, Access to Information and Personal Data Protection, the responsibilities of which will be assumed by the Anti-Corruption and Good Government Ministry.

Another significant change is the new definition of personal data. While this concept continues to refer to “information concerning an identified or identifiable person,” the law no longer establishes that such information must belong to a natural person. Similarly, the definition of owner of personal data removes the requirement of being a natural person to be entitled to all the rights enshrined in the Constitution and in this law regarding personal data. 

This opens the possibility for legal entities to assert the rights of access, rectification, cancellation, and objection and for the person responsible for the processing of personal data to be sanctioned for failure to comply with their obligations to companies, such as providing them with a privacy notice, or obtaining their consent to process their information when required by law, among others.

Notwithstanding the above, it is possible that these concepts will be clarified later in regulations, which are pending harmonization with the new law. These must be published within 90 calendar days of the new law taking effect.  

Among other changes, the FLPPD now establishes the following new obligations for those responsible for the processing of personal data:

• Provide a simplified privacy notice to the data owners when their information is obtained through electronic or technological means.
• Establish controls or mechanisms to ensure that third parties involved in the processing of personal data keep the information confidential, even after the relationship of the controller with the third party has ended.
• Promote the protection of personal data within the organization.

Regarding the rights of the data owners, the following are incorporated into the law:

• Updating personal data as part of the right to rectify the data owner’s information.
• Objecting to the automated processing of personal data when it significantly affects the data owner’s rights and the information is analyzed without human intervention to predict, for example, work performance, reliability, or the behavior of the data owner.

This new legal framework also provides for self-regulation schemes in which those responsible for the processing of personal data may agree among themselves (for example, companies with the same group, suppliers, and customers, etc.) or with civil or governmental (either national or foreign) organizations on the metrics to determine compliance with the legislation, as well as sanctions in the case of noncompliance. This can be translated into codes, policies, regulations, and processes adopted by the parties to the agreement to ensure compliance with the law and make it easier for the owners of personal data to assert their rights in accordance with the law.

Finally, an issue that could generate progress in the protection of personal data in Mexico is that the decree ordering the publication of the FLPPD also requires the establishment of district courts and specialized courts in the matter within 120 calendar days following the entry into force of the decree in order to resolve the requests for constitutional remedies filed by individuals.

Although the penalties for noncompliance with the FLPPD have not changed, it is important to consider that the authority may issue fines ranging from 100 to 320,000 Units of Measurement and Update (currently from $565.70 to $1,810,240), which can be doubled if sensitive data are affected (those whose improper use could result in discrimination).

Given the new law, it is important for employers to verify whether they have privacy notices for their employees, candidates, and other holders of personal data that they process, as well as to confirm if they are taking measures to guarantee data processing in accordance with current legislation.

Estefania Rueda Garcia is an attorney with Littler in Mexico City. © 2025 Littler. All rights reserved. Reposted with permission of Lexology.