Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
Réglementations › Reste du monde › Mexique
LFPDPPP
Loi fédérale sur la protection des données personnelles détenues par les particuliers
QuandEn vigueur depuis le 21 mars 2025
Qui en assure l’applicationSecrétariat à la lutte contre la corruption et à la bonne gouvernance (SABG)
À qui elle s’appliqueParticuliers et entreprises qui effectuent un traitement de données personnelles au Mexique.
Informer le régulateurAucune obligation de notifier le régulateur
DPO requisChaque responsable du traitement doit désigner une personne ou un service de protection des données chargé de traiter les demandes ARCO…
EnregistrementAucun enregistrement ni aucune notification des bases de données auprès du régulateur
Transferts à l’étrangerLes transferts nationaux et internationaux nécessitent un consentement recueilli au moyen de l’avis de confidentialité, sauf exceptions énumérées
Délai de réponse aux demandesRépondre dans un délai de 20 jours ouvrables et donner suite dans un délai de 15 jours ouvrables
Amende maximaleJusqu’à 320,000 UMA (environ MXN 36 millions, soit à peu près USD 2 M), doublé pour les données sensibles, plus un…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Portée et base légale
Portée extraterritoriale
1
Law applies nationwide; the Regulation also reaches non-established controllers that use means located in Mexico (other than transit).Art. 1 LFPDPPP; Art. 4 Regulation (2011) · source ↗
2011 Regulation still applied where not contrary to the 2025 Law; the Executive was to harmonize regulations (Transitorio Décimo Segundo). References to INAI now read as the Secretaría.
Base légale
3
Consent is the default basis; processing without consent only under listed exceptions (law, public sources, legal relationship, emergency, health care, court order). No legitimate interests.Arts. 7, 9 · source ↗
Consentement
1
Tacit consent via privacy notice is valid by default; express consent for financial or patrimonial data; express written consent for sensitive data.Arts. 7, 8 · source ↗
Données sensibles
2
Sensitive data needs express written consent (signature, e-signature or other authentication); databases of sensitive data need a legitimate, specific justification.Arts. 2(VI), 8 · source ↗
Enfants
0
No child-specific rule or age threshold; minors act through representatives under the Federal Civil Code (minority ends at 18).Art. 89 Regulation (2011) · source ↗
2011 Regulation still applied where not contrary to the 2025 Law; the Executive was to harmonize regulations (Transitorio Décimo Segundo). References to INAI now read as the Secretaría.
Droits des personnes
Droits
2
ARCO rights: access, rectification, cancellation and opposition, including objection to automated processing with significant effects. No portability right.Arts. 22-26 · source ↗
Automated-decision protection exists only as an opposition ground (Art. 26(II)).
Délai de réponse aux demandes
2
Respond within 20 business days and implement within 15 business days; each extendable once.Art. 31 · source ↗
Business days (Art. 2(VIII)); 20 business days is roughly four calendar weeks.
Marketing
1
Marketing is a secondary purpose disclosed in the privacy notice; data subjects can object or opt out.Art. 26; Art. 30 Regulation (2011) · source ↗
Federal consumer law (PROFECO's REPEP do-not-call registry) also applies; not reviewed.
Gouvernance
DPO requis
3
Every controller must designate a person or data protection department to handle ARCO requests and promote data protection internally.Art. 29 · source ↗
Qualifications du DPO
0
No qualifications set for the designated person or department.Art. 29 · source ↗
Enregistrement
0
No registration or notification of databases with the regulator.Not addressed · source ↗
DPIA
1
No DPIA duty for controllers; the Regulation requires a security risk analysis and review of risks from new products or technologies.Arts. 48(V), 61(III) Regulation (2011) · source ↗
Art. 39(IX) of the Law gives the Secretaría power to run privacy impact studies, not a controller duty.
Registres
1
Regulation requires an inventory of personal data and processing systems as a security measure; not filed with the regulator.Art. 61(I) Regulation (2011) · source ↗
2011 Regulation still applied where not contrary to the 2025 Law; the Executive was to harmonize regulations (Transitorio Décimo Segundo). References to INAI now read as the Secretaría.
Conservation
2
Data must be blocked, then deleted, once purposes end; records of contractual defaults must be deleted after 72 months.Arts. 2(III), 10, 24 · source ↗
Violations
Information des personnes
2
Notify data subjects immediately of breaches that significantly affect their patrimonial or moral rights.Art. 19; Arts. 64-65 Regulation (2011) · source ↗
Transferts
Transferts à l’étranger
2
Domestic and international transfers need consent via the privacy notice, with listed exceptions; recipient assumes the controller's obligations, typically by contract.Arts. 35-36; Arts. 74-75 Regulation (2011) · source ↗
Application
Amende maximale
2
Up to 320,000 UMA (about MXN 36 million, roughly USD 2m), doubled for sensitive data, plus an additional fine of up to 320,000 UMA for repeat violations.Art. 59 · source ↗
Peso estimate uses the 2025 UMA of MXN 113.14; check the current UMA value.
Responsabilité pénale
2
Imprisonment of 3 months to 3 years for profit-driven breaches by authorized persons and 6 months to 5 years for deceptive processing; doubled for sensitive data.Arts. 62-64 · source ↗
Action privée
2
Administrative sanctions apply without prejudice to civil liability, so data subjects can claim damages in the civil courts.Art. 61 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles