Privacy Law at Mexico
Mexico's data protection landscape underwent significant changes with the enactment of the Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP) on March 20, 2025, which replaced the previous 2010 law. This reform introduced a new regulatory authority, the Secretariat of Anti-Corruption and Good Governance (SABG), following the dissolution of the National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI)
Key Provisions of the LFPDPPP (2025)
Expanded Definition of Data Controller The law now includes both data controllers and processors, broadening the scope of entities subject to its provisions
Enhanced Privacy Notices Organizations must provide comprehensive privacy notices detailing the purposes of data processing, identification of sensitive data, and distinctions between purposes requiring consent and those that do not
Revised Consent Requirements The law eliminates the possibility of processing personal data for purposes similar to those informed in the privacy notice without explicit consent
Regulation of Automated Processing Specific conditions for exercising the right to object, including automated processing through artificial intelligence systems, are established
Amparo Proceedings Decisions made by the SABG can be challenged through amparo proceedings, providing a legal recourse for individuals
🏛️ Role of the Secretariat of Anti-Corruption and Good Governance (SABG
The SABG now oversees the enforcement of data protection laws in Mexio. It is responsible for disseminating knowledge of the right to personal data protection, promoting its exercise, and monitoring compliance with applicable provisions
⚖️ Penalties for Non-Compliance
Violations of the LFPDPPP can result in:
*Monetary Fines: Fines ranging from 100 to 320,000 times the Mexico City minimum wage, with increased penalties for sensitive data violations
*Imprisonment: Individuals responsible for breaches may face imprisonment, especially in cases involving profit-driven violations or exploitation of data subjects' errors
📌 Summary
Mexico's updated data protection law, the LFPDPPP of 2025, introduces comprehensive reforms to enhance personal data protection. With the establishment of the SABG as the new regulatory authority, organizations must adhere to stricter consent requirements, provide detailed privacy notices, and ensure compliance to avoid significant penalties.
RELATED Blog
0 comments