--- title: "Mexico Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/mexico/ source_html: /jurisdictions/mexico/index.html description: "Mexico data protection and privacy regulation: 10 categories, 94 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 4a946073adf4f6628d1bf4e0ba22c8315d498b65bff084ff5710050cecc168d7 generator: "fe-fleet/md-twin@1.0" --- # Mexico Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Mexico Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/mexico/), [World Payments](https://payments.gi/jurisdictions/mexico/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 94 claims · 40 sources in the cumulative register Download report (PDF) Expand all Mexico's data-protection institutional architecture underwent its most consequential change in over two decades this cycle. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (6 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=MEXICO)[Build Report](/reports/?j=MEXICO)[Compare](/compare/?j=MEXICO) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Secretaría Anticorrupción y Buen Gobierno (Dirección General de Datos Personales en e Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 2 Red categories 57 Sub-modules 94 Claims 3 Tier-1 sources Traffic-light mix 8 amber 2 red (sums to 10 rendered categories; click to filter) 2 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 918 Full executive summary 192 ###### Latest update · 4 November 2026 #### Lead Signal Mexico's private-sector data-protection oversight has, as, been in the hands of the Secretaria Anticorrupcion y Buen Gobierno since 21 March 2025, following the dissolution of the National Institute for Transparency, Access to Information and Personal Data Protection under a constitutional reform published 20 December 2024. The shift replaced a constitutionally autonomous body with an executive-branch ministry, and the structural consequence, according to probable-confidence analysis, is a material degradation of institutional independence in data-protection oversight even where the underlying statutory consent standards and fine ceilings have been tightened or left nominally unchanged. One secondary legal-commentary source, assessed at the uncertain tier because it rests on a single source, suggests SABG's role may be limited to disseminating the law's content and promoting compliance, without the rule-making and system-development function INAI held, though this has not been confirmed against the statutory text itself. Separately, the Federal Law on Protection of Personal Data Held by Private Parties carries a header noting a further reform published in the Official Gazette on 14 November 2025; the substantive content of that reform has not been identified, and the finding is limited to confirming that a reform occurred on that date. #### Other Developments The consent standard underpinning all private-sector processing in Mexico remains anchored in the statute's core free, specific and informed test. Under Article 7 of the reformed law, processing of personal data is conditioned on consent given freely, specifically and in an informed manner, a standard that has been in force since the law's 21 March 2025 effective date. Sensitive personal data carries a materially higher bar: Article 8 requires express written consent, evidenced by signature, electronic signature, or another authentication mechanism, and prohibits the creation of sensitive-data databases without legitimate justification. Any change to a privacy notice's stated purposes now requires fresh consent. Analysis of the reformed law indicates that any modification or addition to the purposes set out in a privacy notice will require renewed consent from the data subject, a tightening of the purpose-limitation discipline controllers must observe when their processing activities evolve. #### Cross-Monitor Connections The institutional dissolution of INAI and its replacement by an executive-branch ministry touches on governance and transparency questions that extend beyond data protection narrowly construed; a reader tracking Mexican state-capture or institutional-independence trends more broadly should treat this as a data-protection-side anchor for that separate inquiry, without this brief extending into that analysis itself. #### Outlook The most consequential open question is whether SABG holds formal sanctioning and adjudicative power under the new law, or only a diffusion and promotion role; this has not been confirmed against primary statutory text and is flagged as a specific gap for the coming period. The substantive content of the 14 November 2025 statutory reform likewise remains unidentified and is a priority item for future verification. Until both gaps close, the practical enforceability of Mexico's nominally unchanged fine ceiling and tightened consent standards against the backdrop of a non-autonomous oversight body remains an open and material uncertainty for any entity assessing its Mexican data-protection exposure. 2 earlier updates not shown here. ###### Standing brief · as of 28 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Mexico's data-protection institutional architecture underwent its most consequential change in over two decades this cycle. The Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales (INAI) was formally dissolved as of 21 March 2025, with its data-protection and transparency functions transferred to the Secretaria Anticorrupcion y Buen Gobierno, a federal-executive-branch body. This is a material reduction in institutional independence: unlike INAI, which held constitutionally autonomous status and the power to bring constitutional challenges, the new Secretariat sits within the executive branch and lacks that challenge-bringing authority. The transfer follows a constitutional reform, described by its proponents as "organic simplification," that the Mexican Senate approved to dissolve seven autonomous constitutional bodies altogether, of which INAI was one. Notably, the substantive data-protection rights framework itself is reported by secondary sources to remain largely unchanged: the new LFPDPPP, which replaces the 2010 federal private-sector data-protection law and took effect the same date as INAI's dissolution, is understood to leave data-subject rights and controller obligations substantively intact. The change this cycle is institutional and structural rather than a rewriting of the rights themselves. #### Other Developments Specialised federal courts absorb data-protection litigation. Specialised Federal Judiciary courts for public-information and data-protection litigation began operating on 1 July 2025, absorbing all pending and new proceedings related to public information and data protection. This is part of the broader 2025 institutional transition following INAI's dissolution, and it represents a parallel reallocation of adjudicative authority alongside the executive-branch reallocation of regulatory authority. #### Cross-Monitor Connections The institutional transition described here has no identified direct overlap with financial-integrity, world-payments, advennt, artificial-intelligence or crypto developments this cycle; the dissolution of INAI is a domestic institutional-architecture matter specific to Mexico's transparency and data-protection oversight function. #### Outlook The open question this cycle is whether the new Secretaria Anticorrupcion y Buen Gobierno has yet exercised any enforcement power, such as fines or sanctions, under the LFPDPPP since assuming INAI's functions on 21 March 2025; no such action has been identified in open sources to date. Equally unresolved is the current operating status and caseload of the specialised Federal Judiciary courts created 1 July 2025. Both questions bear directly on whether Mexico's data-protection regime, formally unchanged in substance, is being enforced with comparable vigour under its new executive-branch home. Read full brief · 918 words Standing brief, as of 11 October 2026. #### Regulatory Status Mexico's data-protection regulatory architecture underwent a material institutional change this period: INAI, the constitutionally autonomous body previously responsible for data-protection oversight, was dissolved on 9 May 2025, with its functions transferred to SABG, an executive-branch agency, following a constitutional reform that eliminated seven autonomous bodies. A new LFPDPPP was published on 20 March 2025 and entered into force the following day, replacing the 2010 private-sector law, with a further reform on 14 November 2025 whose content has not yet been retrieved. Despite the institutional transition, SABG demonstrated active enforcement capacity by fining the Federación Mexicana de Fútbol 42,849,095 pesos on 12 July 2026 for biometric data-protection breaches connected to its FAN ID system, with SABG expressly weighing the sensitive nature of the biometric data in setting the penalty. #### Outlook The sustainability and independence of SABG's enforcement function relative to INAI's prior record remains the central open question for Mexico's data-protection regime. The content of the 14 November 2025 LFPDPPP reform, Mexico's current cross-border adequacy and data-transfer posture, and the precise statutory maximum-fine reconciliation under Article 59 all remain open items for future review. Read full brief · 192 words Key regulatory facts for Mexico Regulatory Dimension Mexico Standing Position Jurisdiction Mexico (MX) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 94 sourced findings) Regulator & Framework A comprehensive statute remains in force and a named regulator exists, but the supervising authority itself is mid-transition, independence and procedural rules are unsettled, and mandated secondary regulation is... Lawful Processing & Special Data Core lawful-basis and sensitive-data structures exist and are GDPR-adjacent, but definitional gaps (research/journalistic carve-outs, anonymisation safe-harbour detail) remain unresolved pending new regulations. Data Subject Rights Core ARCO rights are well-established and enforceable, but data portability is confirmed absent from the new statute, and deadline/response-window specifics await the pending implementing regulations. Controller/Processor Duties Security and controller-liability principles exist and are enforceable, but DPO, DPIA, privacy-by-design and regulator-facing breach notification — all GDPR Art. Primary Instruments Cited IAPP, IAPP, OneTrust DataGuidance, OneTrust DataGuidance, IAPP Last Confirmed / Updated 2026-11-04 (40 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Mexico: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A comprehensive statute remains in force and a named regulator exists, but the supervising authority itself is mid-transition, independence and procedural rules are unsettled, and mandated secondary regulation is overdue. Primary framework Ley Federal de Protección de Datos Personales en Posesión de los Particulares (NLFPDPPP, 2025), successor to the 2010 Federal Law Supervisory authority Secretaría Anticorrupción y Buen Gobierno (Dirección General de Datos Personales en el Sector Privado) Traffic-light rationale — Amber A comprehensive statute remains in force and a named regulator exists, but the supervising authority itself is mid-transition, independence and procedural rules are unsettled, and mandated secondary regulation is overdue. #### Sub-modules (5) #### Regulator And AuthorityAmber INAI, the former autonomous DPA, was dissolved by constitutional reform; its private-sector data-protection function was transferred to the Secretaría Anticorrupción y Buen Gobierno, supplemented by two new decentralized bodies created May 2025. Claims (12): - On 28 November 2024 the Mexican Senate approved the 'Simplificación Orgánica' constitutional reform dissolving seven autonomous constitutional bodies, including INAI. - The constitutional reform transfers access-to-information, transparency and personal-data-protection responsibilities to a body within the federal public administration responsible for personal data held by both private and public entities. - On 12 May 2025 the Ministry of Anticorruption and Good Governance announced creation of two new decentralized bodies, Transparencia para el Pueblo and the Personal Data Protection Unit, assuming roughly 80% of INAI's former functions, with a Specialized Court to be established under the judiciary. - INAI dissolved effective 21 March 2025; private-sector data-protection functions transferred to SABG, an executive-branch ministry. - Instituto Nacional de Transparencia (INAI) — INAI was formally dissolved as of 21 March 2025 under a constitutional 'organic simplification' reform; data-protection and transparency functions transferred to the executive-branch SABG, which lacks INAI's power to bring constitutional challenges. - Secretaría Anticorrupción y Buen Gobierno (SABG) — SABG replaced INAI as the MX data-protection authority effective 21 March 2025. - SABG's role under the new regime may be limited to dissemination and promotion rather than rule-making. - Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) — INAI dissolved effective 21 March 2025; private-sector data-protection functions transferred to the Secretaría Anticorrupción y Buen Gobierno (SABG) - Secretaría Anticorrupción y Buen Gobierno (SABG) — SABG's role is limited to disseminating the law's content and promoting compliance, without INAI's rule-making/system-development function, per one secondary source - INAI — Dissolved 9 May 2025; functions transferred to Secretaría Anticorrupción y Buen Gobierno following constitutional 'simplificación orgánica' reform eliminating seven autonomous bodies - INAI / Secretaría Anticorrupción y Buen Gobierno (SABG) — A constitutional reform dissolved the autonomous INAI; implementing legislation effective 2025-03-21 transferred data-protection oversight to the executive-branch SABG - LFPDPPP decree — INAI's material resources to SABG and financial resources to SHCP within 20 business days of entry into force #### Act And InstrumentsGreen The operative private-sector instrument is the NLFPDPPP (DOF 20 Mar 2025, in force 21 Mar 2025), which repealed the 2010 FLPPDPP; a parallel General Law covers public-sector 'obligated parties'. Claims (8): - The New Federal Law for the Protection of Personal Data in Possession of Private Parties (NLFPDPPP) was published in the DOF on 20 March 2025 and entered into force 21 March 2025, superseding and repealing the 2010 FLPPDPP. - The Executive Branch is mandated to issue updated implementing regulations within 90 days of the NLFPDPPP's entry into force to harmonize the regulatory framework, with the prior 2010 Regulations remaining only provisionally applicable in the interim. - LFPDPPP / LGPDPPSO — A single decree enacted a rewritten LFPDPPP (private sector) and a new LGPDPPSO (public sector), both effective 21 March 2025, abrogating the 2010 private-sector data-protection law. - LFPDPPP 2025 — The new LFPDPPP (DOF 20 March 2025, effective 21 March 2025) abrogates the Federal Law on the Protection of Personal Data Held by Private Parties published in 2010. - A further reform to the LFPDPPP was published in the DOF on 14 November 2025. - Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) — Current LFPDPPP text carries a header noting 'Última reforma publicada DOF 14-11-2025'; substantive content of that reform not identified - LFPDPPP (2025) — Replaces the 2010 federal private-sector data-protection law but is reported by multiple secondary sources to leave data-subject rights and controller obligations substantively unchanged - New LFPDPPP published DOF 20 March 2025, in force 21 March 2025, abrogates the 2010 private-sector data-protection law; last reformed DOF 14 November 2025 #### Material ScopeGreen The law governs legitimate, controlled and informed processing of personal data by private parties to guarantee privacy and informational self-determination; credit-reporting entities remain carved out under separate sectoral law. Claims (1): - Credit-reporting entities are exempt from the general private-sector data protection law because they are subject to separate sectoral regulation. #### Territorial ScopeAmber The private-sector law has historically applied on a territorial basis to processing by companies/persons established in Mexico regardless of data-subject residence; the new law preserves this structure. Claims (2): - The private-sector data protection statute applies to processing of personal data by companies and persons on Mexican territory regardless of where the data subjects reside, requiring Mexican-based internet companies to comply even for non-Mexican users' data. - LFPDPPP Regulations Art. 4 — Applies extraterritorially only in specific enumerated cases, including establishment in Mexico #### Regulator Registration And FilingRed No dedicated national registry/filing obligation for controllers was identified in the sources reviewed for the private-sector regime. Claims (1): - Procedures initiated before INAI prior to the reform continue under the rules in effect at their initiation, now before SABG; INAI was formally dissolved as an autonomous constitutional body. Mexico's private-sector data protection regime underwent a foundational institutional rupture between Nov 2024 and mid-2025. The Senate approved a constitutional 'organic simplification' reform dissolving seven autonomous bodies including INAI (the former DPA), with functions redistributed to the federal executive branch. A New Federal Law for the Protection of Personal Data Held by Private Parties (NLFPDPPP) was published 20 March 2025 (effective 21 March 2025), repealing the 2010 FLPPDPP, alongside a companion General Law for the public sector. The Secretaría Anticorrupción y Buen Gobierno, acting through its Dirección General de Datos Personales en el Sector Privado, now exercises the former INAI's private-sector functions; two decentralized administrative bodies (Transparencia para el Pueblo and the Personal Data Protection Unit) were stood up in May 2025 to absorb roughly 80% of INAI's functions, with a Specialized Court under the judiciary also contemplated. As of mid-2026 the new authority had not yet issued the harmonizing secondary regulation mandated within 90 days of the NLFPDPPP's entry into force. Periodic update · new data 2026-11-04 #### Regulator & Framework Mexico's private-sector data-protection oversight structure changed fundamentally with the dissolution of the National Institute for Transparency, Access to Information and Personal Data Protection, effective 21 March 2025, pursuant to a constitutional reform published 20 December 2024. The functions INAI previously held over private-sector personal-data processing passed to the Secretaria Anticorrupcion y Buen Gobierno, a ministry within the executive branch rather than a constitutionally autonomous body of the kind INAI was. This is assessed at the probable confidence tier on the strength of the constitutional-reform record and is treated as the single most structurally significant development in Mexico's data-protection regime captured. A secondary legal-commentary source, resting on a single citation and therefore held at the uncertain tier, suggests that SABG's role under the new arrangement may be confined to disseminating the content of the law and promoting compliance with it, without the rule-making or system-development authority INAI formerly exercised. This has not been verified against the statutory text directly and should be read as an open question rather than a settled finding. Separately, the Federal Law on Protection of Personal Data Held by Private Parties, the private-sector data-protection statute itself, carries a textual notice that its last reform was published in the Official Gazette on 14 November 2025. The substantive content of that reform, what provisions changed and why, has not been identified from the sources available; what can be said with confidence is only that a reform occurred on that date. A separate body, referred to in commentary as Transparencia para el Pueblo, is reported to be created to handle public-sector information-access functions previously held by INAI, though this sits on the access-to-information side of the prior INAI mandate rather than the private-sector data-protection side that is this monitor's focus. #### Outlook Two verification gaps dominate the near-term outlook for this module. First, whether SABG holds genuine sanctioning and rule-making authority, or only a dissemination and promotion function, remains unconfirmed against the statute itself and is the single most consequential open question for assessing the practical strength of Mexican data-protection enforcement going forward. Second, the substantive content of the 14 November 2025 statutory reform has not yet been identified and will need to be reviewed directly against the gazette text once available. Until both are resolved, Mexico's private-sector data-protection framework should be read as formally reformed but functionally uncertain in its enforcement architecture. 3 earlier distinct update(s) Periodic update · new data 2026-11-03 #### Regulator & Framework A constitutional reform dissolved Mexico's Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), the body that had served as Mexico's autonomous data-protection authority. Implementing legislation, effective 21 March 2025, transferred data-protection oversight to the Secretaría Anticorrupción y Buen Gobierno (SABG), an executive-branch body. This represents a material reduction in institutional independence compared to INAI's prior status as a constitutionally autonomous body, since SABG sits within the executive branch rather than operating as an independent authority insulated from executive direction. SABG had not published implementing regulations for the 2025 legal framework it now administers, leaving interpretive uncertainty around several aspects of the new regime's practical operation. Notwithstanding that gap, SABG has already exercised its enforcement authority: the 12 July 2026 fine against the Mexican Football Federation represents the first published sanction under the 2025 LFPDPPP framework, suggesting the new regulator intends to exercise an assertive enforcement posture even in the absence of published implementing regulations. The combination of reduced institutional independence and an assertive opening enforcement signal is the defining structural tension in Mexico's data-protection framework at this stage: a regulator with potentially diminished independence from executive influence has nonetheless demonstrated a willingness to impose record-scale fines, raising questions about how enforcement priorities will be set and whether they will be shaped by considerations beyond data-protection compliance alone. #### Outlook The clearest marker to watch is whether and when SABG publishes implementing regulations for the 2025 legal framework, which would resolve significant interpretive uncertainty currently surrounding the regime's practical scope. The question of SABG's effective independence from executive direction, despite its enforcement activity to date, remains an open structural question that subsequent enforcement patterns may help clarify. Periodic update · new data 2026-10-18 #### Regulator & Framework A constitutional reform dissolved Mexico's Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), the body that had served as Mexico's autonomous data-protection authority. Implementing legislation, effective 21 March 2025, transferred data-protection oversight to the Secretaría Anticorrupción y Buen Gobierno (SABG), an executive-branch body. This represents a material reduction in institutional independence compared to INAI's prior status as a constitutionally autonomous body, since SABG sits within the executive branch rather than operating as an independent authority insulated from executive direction. As of this cycle, SABG had not published implementing regulations for the 2025 legal framework it now administers, leaving interpretive uncertainty around several aspects of the new regime's practical operation. Notwithstanding that gap, SABG has already exercised its enforcement authority: the 12 July 2026 fine against the Mexican Football Federation represents the first published sanction under the 2025 LFPDPPP framework, suggesting the new regulator intends to exercise an assertive enforcement posture even in the absence of published implementing regulations. The combination of reduced institutional independence and an assertive opening enforcement signal is the defining structural tension in Mexico's data-protection framework at this stage: a regulator with potentially diminished independence from executive influence has nonetheless demonstrated a willingness to impose record-scale fines, raising questions about how enforcement priorities will be set and whether they will be shaped by considerations beyond data-protection compliance alone. #### Outlook The clearest marker to watch is whether and when SABG publishes implementing regulations for the 2025 legal framework, which would resolve significant interpretive uncertainty currently surrounding the regime's practical scope. The question of SABG's effective independence from executive direction, despite its enforcement activity to date, remains an open structural question that subsequent enforcement patterns may help clarify. Periodic update · new data 2026-10-11 #### Regulator & Framework Mexico's data-protection regulator, the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, was dissolved on 9 May 2025, with its functions transferred to the Secretaría Anticorrupción y Buen Gobierno, an agency situated within the executive branch. This followed a constitutional "simplificación orgánica" reform that eliminated seven autonomous bodies. Under the transitional provisions of the reform, INAI's material resources were directed to SABG and its financial resources to the Secretaría de Hacienda y Crédito Público within 20 business days of the reform's entry into force. This transfer is a material change in the institutional architecture governing data protection in Mexico, moving oversight from a body with constitutionally guaranteed autonomy and accountability to Congress to an agency within the executive branch, reporting through the ordinary government hierarchy. Separately, a new Ley Federal de Protección de Datos Personales en Posesión de los Particulares was published in the Diario Oficial de la Federación on 20 March 2025, entering into force the following day and abrogating the 2010 private-sector data-protection law that preceded it. The new law was subsequently reformed on 14 November 2025, though the substantive content of that reform has not yet been retrieved, leaving an open question about what, if anything, changed in the underlying rights and obligations framework at that point. #### Outlook The central open question is whether SABG's enforcement and rulemaking activity under the new institutional structure will match the pace and independence of INAI's prior record. The 12 July 2026 fine against the Federación Mexicana de Fútbol, addressed separately in enforcement coverage, is an early indication that SABG retains active enforcement capacity, but enforcement capacity under executive-branch structure is a distinct question from supervisory independence. The content of the 14 November 2025 LFPDPPP reform remains an open item for future review. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (24) - [IAPP](https://iapp.org/news/a/se-establece-una-nueva-autoridad-en-materia-de-protecci-n-de-datos-personales-en-m-xico) — On 28 November 2024 the Mexican Senate approved the 'Simplificación Orgánica' constitutional reform dissolving seven autonomous constitutional bodies, including INAI. - [IAPP](https://iapp.org/news/a/new-authority-established-for-personal-data-protection-in-mexico) — The constitutional reform transfers access-to-information, transparency and personal-data-protection responsibilities to a body within the federal public administration responsible for personal data held by both private and public entities. - [OneTrust DataGuidance](https://www.dataguidance.com/news/mexico-ministry-launches-new-institutions-transparency) — On 12 May 2025 the Ministry of Anticorruption and Good Governance announced creation of two new decentralized bodies, Transparencia para el Pueblo and the Personal Data Protection Unit, assuming roughly 80% of INAI's former functions, with a Specialized Court to be established under the judiciary. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/mexico) — The New Federal Law for the Protection of Personal Data in Possession of Private Parties (NLFPDPPP) was published in the DOF on 20 March 2025 and entered into force 21 March 2025, superseding and repealing the 2010 FLPPDPP. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/mexico) — The Executive Branch is mandated to issue updated implementing regulations within 90 days of the NLFPDPPP's entry into force to harmonize the regulatory framework, with the prior 2010 Regulations remaining only provisionally applicable in the interim. - [IAPP](https://iapp.org/news/a/2010-10-26-new-data-privacy-law-in-mexico) — Credit-reporting entities are exempt from the general private-sector data protection law because they are subject to separate sectoral regulation. - [IAPP](https://iapp.org/news/a/2010-10-26-new-data-privacy-law-in-mexico) — The private-sector data protection statute applies to processing of personal data by companies and persons on Mexican territory regardless of where the data subjects reside, requiring Mexican-based internet companies to comply even for non-Mexican users' data. - [Wikipedia (ES)](https://es.wikipedia.org/wiki/Instituto_Nacional_de_Transparencia,_Acceso_a_la_Informaci%C3%B3n_y_Protecci%C3%B3n_de_Datos_Personales) — INAI dissolved effective 21 March 2025; private-sector data-protection functions transferred to SABG, an executive-branch ministry. - [Wikipedia (ES)](https://es.wikipedia.org/wiki/Instituto_Nacional_de_Transparencia,_Acceso_a_la_Informaci%C3%B3n_y_Protecci%C3%B3n_de_Datos_Personales) — Instituto Nacional de Transparencia (INAI) — INAI was formally dissolved as of 21 March 2025 under a constitutional 'organic simplification' reform; data-protection and transparency functions transferred to the executive-branch SABG, which lacks INAI's power to bring constitutional challenges. - [IDC Online](https://idconline.mx/corporativo/2025/04/02/que-asumio-la-secretaria-anticorrupcion-tras-la-desaparicion-del-inai) — LFPDPPP / LGPDPPSO — A single decree enacted a rewritten LFPDPPP (private sector) and a new LGPDPPSO (public sector), both effective 21 March 2025, abrogating the 2010 private-sector data-protection law. - [Greenberg Traurig](https://www.gtlaw.com/en/insights/2025/3/nueva-ley-general-proteccion-de-datos) — Secretaría Anticorrupción y Buen Gobierno (SABG) — SABG replaced INAI as the MX data-protection authority effective 21 March 2025. - [BASHAM](https://basham.com.mx/en/nueva-ley-federal-de-proteccion-de-datos-personales-en-posesion-de-los-particulares-publicada-en-el-diario-oficial-de-la-federacion/) — LFPDPPP 2025 — The new LFPDPPP (DOF 20 March 2025, effective 21 March 2025) abrogates the Federal Law on the Protection of Personal Data Held by Private Parties published in 2010. - [National Law Review](https://natlawreview.com/article/mexicos-federal-government-initiates-process-eliminate-autonomous-data-privacy) — Procedures initiated before INAI prior to the reform continue under the rules in effect at their initiation, now before SABG; INAI was formally dissolved as an autonomous constitutional body. - [IDC Online](https://idconline.mx/corporativo/2025/04/02/que-asumio-la-secretaria-anticorrupcion-tras-la-desaparicion-del-inai) — SABG's role under the new regime may be limited to dissemination and promotion rather than rule-making. - [Cámara de Diputados](http://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf) — A further reform to the LFPDPPP was published in the DOF on 14 November 2025. - [Wikipedia (ES)](https://es.wikipedia.org/wiki/Instituto_Nacional_de_Transparencia,_Acceso_a_la_Informaci%C3%B3n_y_Protecci%C3%B3n_de_Datos_Personales) — Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) — INAI dissolved effective 21 March 2025; private-sector data-protection functions transferred to the Secretaría Anticorrupción y Buen Gobierno (SABG) - [IDC Online](https://idconline.mx/corporativo/2025/04/02/que-asumio-la-secretaria-anticorrupcion-tras-la-desaparicion-del-inai) — Secretaría Anticorrupción y Buen Gobierno (SABG) — SABG's role is limited to disseminating the law's content and promoting compliance, without INAI's rule-making/system-development function, per one secondary source - [Cámara de Diputados](http://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf) — Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) — Current LFPDPPP text carries a header noting 'Última reforma publicada DOF 14-11-2025'; substantive content of that reform not identified - [Infobae](https://www.infobae.com/mexico/2025/05/10/inai-desaparece-secretaria-anticorrupcion-y-buen-gobierno-asume-funciones/) — INAI — Dissolved 9 May 2025; functions transferred to Secretaría Anticorrupción y Buen Gobierno following constitutional 'simplificación orgánica' reform eliminating seven autonomous bodies - [National Law Review](https://natlawreview.com/article/mexicos-federal-government-initiates-process-eliminate-autonomous-data-privacy) — INAI / Secretaría Anticorrupción y Buen Gobierno (SABG) — A constitutional reform dissolved the autonomous INAI; implementing legislation effective 2025-03-21 transferred data-protection oversight to the executive-branch SABG - [IDC Online](https://idconline.mx/corporativo/2025/04/02/que-asumio-la-secretaria-anticorrupcion-tras-la-desaparicion-del-inai) — LFPDPPP (2025) — Replaces the 2010 federal private-sector data-protection law but is reported by multiple secondary sources to leave data-subject rights and controller obligations substantively unchanged - [Cámara de Diputados](http://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf) — LFPDPPP Regulations Art. 4 — Applies extraterritorially only in specific enumerated cases, including establishment in Mexico - [https://www.ordenjuridico.gob.mx/Documentos/Federal/html/wo125102.html](https://www.ordenjuridico.gob.mx/Documentos/Federal/html/wo125102.html) — LFPDPPP decree — INAI's material resources to SABG and financial resources to SHCP within 20 business days of entry into force - [https://www.ordenjuridico.gob.mx/Documentos/Federal/html/wo125102.html](https://www.ordenjuridico.gob.mx/Documentos/Federal/html/wo125102.html) — New LFPDPPP published DOF 20 March 2025, in force 21 March 2025, abrogates the 2010 private-sector data-protection law; last reformed DOF 14 November 2025 ### Mexico: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core lawful-basis and sensitive-data structures exist and are GDPR-adjacent, but definitional gaps (research/journalistic carve-outs, anonymisation safe-harbour detail) remain unresolved pending new regulations. Primary framework NLFPDPPP Arts. 6-22 (principles, consent, sensitive data) Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Amber Core lawful-basis and sensitive-data structures exist and are GDPR-adjacent, but definitional gaps (research/journalistic carve-outs, anonymisation safe-harbour detail) remain unresolved pending new regulations. Periodic update · new data 2026-11-04 #### Lawful Processing & Special Data The core lawful-processing standard under the Federal Law on Protection of Personal Data Held by Private Parties, in force since 21 March 2025, conditions all processing of personal data on consent given freely, specifically and in an informed manner, under Article 7 of the statute. This standard has not changed in its basic formulation from the prior regime, but its practical application has been reinforced by a related tightening: analysis of the reformed law indicates that any modification or addition to the purposes stated in a controller's privacy notice will require renewed consent from the data subject, closing a gap that previously allowed some purpose drift without a fresh consent event. For sensitive personal data, Article 8 sets a materially higher bar than the general consent standard. Processing of sensitive categories requires express written consent, which may be evidenced by a physical signature, an electronic signature, or another authentication mechanism recognised under the law, and the statute separately prohibits the creation of databases of sensitive personal data without legitimate justification for doing so. This dual structure, a general freely-specific-informed standard alongside a heightened express-written-consent requirement for sensitive categories, places Mexico's lawful-processing architecture within a recognisably rigorous consent-based model, though the underlying sourcing for the sensitive-data provision rests on a single secondary legal-analysis source and is accordingly held at the probable rather than confirmed tier. The purpose-limitation tightening, requiring fresh consent on any purpose modification, has a direct practical effect on controllers who update privacy notices to reflect new processing activities, data-sharing arrangements, or product features: each such change now carries its own consent-renewal obligation rather than being absorbed under a previously broader notice. #### Outlook No further legislative change to the lawful-processing or special-category framework is reported as pending. The practical test of the tightened purpose-limitation rule will be how consistently controllers across sectors implement renewed-consent mechanisms when privacy notices change, a question the sourcing does not allow an answer to. The sensitive-data consent requirement's interaction with the institutional uncertainty noted elsewhere, regarding SABG's enforcement authority, remains a relevant consideration for assessing how rigorously Article 8 will in practice be supervised. D2 · Lawful Processing — Full Module Record 4 sub-modules · 63 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mexico: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core ARCO rights are well-established and enforceable, but data portability is confirmed absent from the new statute, and deadline/response-window specifics await the pending implementing regulations. Primary framework NLFPDPPP Arts. 16-25 (ARCO rights procedure) Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Amber Core ARCO rights are well-established and enforceable, but data portability is confirmed absent from the new statute, and deadline/response-window specifics await the pending implementing regulations. #### Sub-modules (5) #### Access RightGreen The new law broadens the access right beyond simply knowing processed data and the privacy notice, to include information on the general conditions of processing. Claims (3): - ARCO rights (access, rectification, cancellation and opposition) form the procedural core of data-subject rights under the private-sector data protection law. - The New Law redefines the access right so that the data subject may access personal data and also know general conditions of the processing, expanding beyond the prior law's narrower formulation. - The new LFPDPPP preserves the four ARCO rights as the procedural core of data-subject rights, with the cancellation right now explicitly extended to the systems and records where data is stored. #### Rectification And ErasureGreen Both GDPR and the Mexican Federal Law recognize a right to request cancellation/erasure of data in certain circumstances; deletion is also required once data is no longer necessary for the stated purpose. Claims (4): - Both the GDPR and the Mexican Federal Law provide that data subjects may request cancellation or erasure of their data in certain circumstances for legitimate reasons. - Personal data must be deleted where it is no longer required for the purposes indicated in the privacy notice provided to data subjects. - The right of cancellation now expressly extends to files, records, dossiers and systems of the controller. - LFPDPPP cancellation right — Right of cancellation extends to files, records, dossiers and systems of the data controller where personal data are held #### Restriction And ObjectionAmber Opposition (the 'O' in ARCO) is a recognized right; restriction as a distinct GDPR-style concept is not separately elaborated in the sources reviewed. Claims (1): - Opposition to processing is recognized as one of the four ARCO rights under the private-sector framework. #### Data PortabilityRed Practitioner review of the enacted NLFPDPPP text confirms the new law does not include a data portability right, despite general secondary summaries describing 'enhanced' rights. Claims (1): - Practitioner analysis of the enacted NLFPDPPP text confirms the new law does not include a data portability right, among other omissions relative to GDPR-style frameworks. #### Deadlines And Response WindowsAmber Historically, data controllers/authorities operated under short compliance windows (e.g., 10 days to comply with an IFAI/INAI resolution); NLFPDPPP-specific response-window detail awaits the pending implementing regulation. Claims (2): - Under the 2010-era framework, data collectors had 10 days to comply with a resolution issued by the data protection authority. - Against resolutions of the new Secretaría (replacing INAI), affected parties may now pursue amparo proceedings before specialized district and circuit courts, which were to be enabled within 120 calendar days of the reform decree's publication (i.e., by 19 June 2025). Mexico's rights framework centers on the ARCO rights (access, rectification, cancellation, opposition). The NLFPDPPP broadens the definition of the access right to include information about the conditions of processing, and replaces judicial review of regulator resolutions from nullity trials to amparo proceedings before newly created specialized federal courts. Critically, per detailed practitioner analysis of the enacted text, the new law does NOT include a data portability right, in contrast to a DataGuidance summary describing 'enhanced' data subject rights generally — this is flagged as an unresolved conflict pending primary-text confirmation. No periodic updates recorded in this cycle Sources and claims (11) - [IAPP](https://iapp.org/news/a/de-lo-internacional-a-lo-nacional-reto-de-la-regulacion-y-desregulacion-normativa-de-los-datos-personales) — ARCO rights (access, rectification, cancellation and opposition) form the procedural core of data-subject rights under the private-sector data protection law. - [IAPP](https://iapp.org/news/a/entendiendo-la-ley-federal-de-protecci-n-de-datos-personales-en-posesi-n-de-los-particulares-en-mexico) — The New Law redefines the access right so that the data subject may access personal data and also know general conditions of the processing, expanding beyond the prior law's narrower formulation. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/eu_-_mexico-_gdpr_v._federal_law_and_regulations_.pdf) — Both the GDPR and the Mexican Federal Law provide that data subjects may request cancellation or erasure of their data in certain circumstances for legitimate reasons. - [IAPP](https://iapp.org/news/a/2010-10-26-new-data-privacy-law-in-mexico) — Personal data must be deleted where it is no longer required for the purposes indicated in the privacy notice provided to data subjects. - [IAPP](https://iapp.org/news/a/de-lo-internacional-a-lo-nacional-reto-de-la-regulacion-y-desregulacion-normativa-de-los-datos-personales) — Opposition to processing is recognized as one of the four ARCO rights under the private-sector framework. - [IAPP](https://iapp.org/news/a/entendiendo-la-ley-federal-de-protecci-n-de-datos-personales-en-posesi-n-de-los-particulares-en-mexico) — Practitioner analysis of the enacted NLFPDPPP text confirms the new law does not include a data portability right, among other omissions relative to GDPR-style frameworks. - [IAPP](https://iapp.org/news/a/2010-10-26-new-data-privacy-law-in-mexico) — Under the 2010-era framework, data collectors had 10 days to comply with a resolution issued by the data protection authority. - [IAPP](https://iapp.org/news/a/entendiendo-la-ley-federal-de-protecci-n-de-datos-personales-en-posesi-n-de-los-particulares-en-mexico) — Against resolutions of the new Secretaría (replacing INAI), affected parties may now pursue amparo proceedings before specialized district and circuit courts, which were to be enabled within 120 calendar days of the reform decree's publication (i.e., by 19 June 2025). - [Cámara de Diputados](http://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf) — The new LFPDPPP preserves the four ARCO rights as the procedural core of data-subject rights, with the cancellation right now explicitly extended to the systems and records where data is stored. - [BASHAM](https://basham.com.mx/en/nueva-ley-federal-de-proteccion-de-datos-personales-en-posesion-de-los-particulares-publicada-en-el-diario-oficial-de-la-federacion/) — The right of cancellation now expressly extends to files, records, dossiers and systems of the controller. - [BASHAM](https://basham.com.mx/en/nueva-ley-federal-de-proteccion-de-datos-personales-en-posesion-de-los-particulares-publicada-en-el-diario-oficial-de-la-federacion/) — LFPDPPP cancellation right — Right of cancellation extends to files, records, dossiers and systems of the data controller where personal data are held ### Mexico: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Security and controller-liability principles exist and are enforceable, but DPO, DPIA, privacy-by-design and regulator-facing breach notification — all GDPR Art. 25/33/35/37-39 analogues — are confirmed absent from the current statute and Regulations. Primary framework NLFPDPPP + (provisionally) 2010 FLPPDPP Regulations, pending updated Reglamento Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Amber Security and controller-liability principles exist and are enforceable, but DPO, DPIA, privacy-by-design and regulator-facing breach notification — all GDPR Art. 25/33/35/37-39 analogues — are confirmed absent from the current statute and Regulations. D4 · Controller & Processor — Full Module Record 7 sub-modules · 79 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mexico: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A transfer mechanism exists in statute but enforcement reach is explicitly limited by the authority's own historical acknowledgment of extraterritorial enforcement gaps, and SCC/BCR/TIA/localisation specifics are largely undocumented in current secondary sources. Primary framework NLFPDPPP Art. 36 (international transfer clause in privacy notice) Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Amber A transfer mechanism exists in statute but enforcement reach is explicitly limited by the authority's own historical acknowledgment of extraterritorial enforcement gaps, and SCC/BCR/TIA/localisation specifics are largely undocumented in current secondary sources. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 75 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mexico: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector overlay is well documented; health, telecoms, education and insurance overlays are thinly evidenced or absent in the sources reviewed. Supervisory authority Comisión Nacional Bancaria y de Valores (CNBV) Traffic-light rationale — Amber Financial-sector overlay is well documented; health, telecoms, education and insurance overlays are thinly evidenced or absent in the sources reviewed. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 41 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mexico: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No dedicated adtech/commercial-privacy regime exists; only the general opposition right within ARCO offers any traction for direct-marketing objections. Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Red No dedicated adtech/commercial-privacy regime exists; only the general opposition right within ARCO offers any traction for direct-marketing objections. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 43 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mexico: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ No binding AI-specific statute exists; biometric governance rests on enforcement precedent rather than codified rules, and profiling/ADM-transparency provisions were not separately documented. Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Amber No binding AI-specific statute exists; biometric governance rests on enforcement precedent rather than codified rules, and profiling/ADM-transparency provisions were not separately documented. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance SABG's FAN ID enforcement decision against the Mexican Football Federation is the clearest confirmation to date that biometric data is treated as sensitive personal data under Mexico's data-protection framework, requiring both explicit identification as sensitive in a controller's privacy notice and a heightened consent standard beyond simple checkbox acknowledgment. The FAN ID programme itself involved biometric identity verification, a category of processing that sits squarely within the algorithmic and biometric governance space given its use for identity-matching and verification purposes at scale, likely across a large number of football spectators or participants. The scale of the resulting fine — 42,849,095 Mexican pesos, approximately 2.14 million US dollars — and its description as one of the most significant data-protection enforcement actions in Mexico to date, signals that biometric identity-verification programmes of this kind now carry materially elevated compliance risk in Mexico. For any organization deploying biometric identity-verification technology at scale in Mexico, including for event access, security or authentication purposes, the FAN ID decision establishes a concrete enforcement benchmark: the mere technical accuracy or security of a biometric system does not satisfy compliance obligations if the privacy notice fails to classify the data as sensitive and if consent is obtained through a mechanism the regulator considers inadequate for sensitive-category processing. #### Outlook Organizations operating biometric identity-verification systems in Mexico should expect continued SABG scrutiny of consent mechanisms and privacy-notice classifications following this precedent-setting action; watch for whether SABG pursues further biometric-processing enforcement actions against other sectors beyond sports and event-access use cases. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 96 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mexico: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ The current statute contains no children's-data-specific regime at all; this is an explicit, confirmed statutory gap rather than a mere silence in secondary sources. Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Red The current statute contains no children's-data-specific regime at all; this is an explicit, confirmed statutory gap rather than a mere silence in secondary sources. D9 · Children's Privacy — Full Module Record 5 sub-modules · 52 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mexico: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A functioning enforcement and judicial-review pathway exists, but the new regulator's operational capacity, sanctioning track record, and independence remain unproven during this institutional transition. Primary framework NLFPDPPP enforcement + amparo judicial review procedure Supervisory authority Secretaría Anticorrupción y Buen Gobierno Traffic-light rationale — Amber A functioning enforcement and judicial-review pathway exists, but the new regulator's operational capacity, sanctioning track record, and independence remain unproven during this institutional transition. Periodic update · new data 2026-11-04 #### Enforcement & Redress The maximum administrative fine under Mexico's private-sector data-protection law remains set at 320,000 units of measure and update (UMA), equivalent to approximately 37.5 million Mexican pesos at 2026 UMA values. The unit of measurement has changed over time, from a prior basis tied to minimum-wage days to the current UMA-based calculation, but the nominal multiplier underlying the ceiling is reported as unchanged. This figure rests on a single secondary compliance-sector source and is held at the probable tier with medium translation confidence on the specific peso-equivalent conversion. The more structurally significant enforcement development is institutional rather than numeric. Because SABG, the body now responsible for private-sector data-protection oversight, is an executive-branch ministry rather than a constitutionally autonomous body of the kind INAI was, data subjects and controllers no longer have access to the independent, tribunal-style review process that INAI formerly provided. This finding is assessed at the probable confidence tier and is treated, consistent with the interpreter's own key judgment, as a material degradation of enforcement credibility: a nominally unchanged or even tightened fine ceiling carries materially different practical weight when the body empowered to impose it lacks the independence from executive-branch direction that its predecessor held. Whether SABG retains any formal sanctioning or adjudicative power at all under the new statutory arrangement, as distinct from a purely dissemination and promotion role, has not been confirmed against primary statutory text and stands as an open verification gap. The combination of these two findings, an unchanged penalty ceiling paired with a materially weakened independent-review mechanism, is the central enforcement-and-redress story for Mexico: the formal numbers have not moved, but the institutional path by which those numbers would be applied, contested, or reviewed has changed in a way that reduces the credibility of the regime as previously understood. #### Outlook Resolving whether SABG holds genuine sanctioning authority, or only a dissemination and promotion function, is the single highest-priority open question for this module going forward, and until it is resolved against primary statutory text, any assessment of Mexico's practical enforcement posture should be treated as provisional. The loss of an autonomous tribunal-style review mechanism is likely to remain the defining enforcement-and-redress characteristic of the Mexican regime for the foreseeable period, independent of whatever administrative penalty figures remain formally on the books. Periodic update · new data 2026-11-03 #### Enforcement & Redress On 12 July 2026, Mexico's Secretaría Anticorrupción y Buen Gobierno (SABG) imposed a fine of 42,849,095 Mexican pesos, approximately 2.14 million US dollars, against the Federación Mexicana de Futbol Asociación over its FAN ID biometric data processing programme. This is reported as the first published sanction under the 2025 LFPDPPP framework and is described as one of the most significant data-protection enforcement actions in Mexico to date. The decision found two distinct failures: the federation did not flag photographs as sensitive data in its privacy notice, and it obtained consent through an inadequate checkbox mechanism, rather than a mechanism meeting the heightened standard required for sensitive-category processing. Separately, secondary commentary describes an amparo-based judicial review pathway for SABG's private-sector data-protection decisions, reportedly consolidated into specialised federal data-protection district courts that handle ARCO-rights litigation within a single federal circuit. This commentary was sourced from a lower-tier secondary source, and the exact commencement date and operational scope of these specialised courts was not independently verified, so this element should be treated as probable rather than confirmed pending primary-source verification. Taken together, the FAN ID fine represents a concrete test case for Mexico's new enforcement architecture under SABG: a record-scale sanction, issued by an executive-branch body rather than an autonomous authority, for a clearly articulated set of sensitive-data and consent failures. The scale and specificity of the decision suggest SABG intends to establish enforcement credibility notwithstanding the institutional-independence question raised by INAI's dissolution. #### Outlook Watch for whether further SABG enforcement actions follow a similar pattern of sensitive-data and consent-mechanism scrutiny, and for independent verification of the specialised federal data-protection court system's commencement date and scope, which would clarify the judicial-review pathway available to parties affected by SABG decisions. Periodic update · new data 2026-10-18 #### Enforcement & Redress On 12 July 2026, Mexico's Secretaría Anticorrupción y Buen Gobierno (SABG) imposed a fine of 42,849,095 Mexican pesos, approximately 2.14 million US dollars, against the Federación Mexicana de Futbol Asociación over its FAN ID biometric data processing programme. This is reported as the first published sanction under the 2025 LFPDPPP framework and is described as one of the most significant data-protection enforcement actions in Mexico to date. The decision found two distinct failures: the federation did not flag photographs as sensitive data in its privacy notice, and it obtained consent through an inadequate checkbox mechanism, rather than a mechanism meeting the heightened standard required for sensitive-category processing. Separately, secondary commentary describes an amparo-based judicial review pathway for SABG's private-sector data-protection decisions, reportedly consolidated into specialised federal data-protection district courts that handle ARCO-rights litigation within a single federal circuit. This commentary was sourced from a lower-tier secondary source, and the exact commencement date and operational scope of these specialised courts was not independently verified this cycle, so this element should be treated as probable rather than confirmed pending primary-source verification. Taken together, the FAN ID fine represents a concrete test case for Mexico's new enforcement architecture under SABG: a record-scale sanction, issued by an executive-branch body rather than an autonomous authority, for a clearly articulated set of sensitive-data and consent failures. The scale and specificity of the decision suggest SABG intends to establish enforcement credibility notwithstanding the institutional-independence question raised by INAI's dissolution. #### Outlook Watch for whether further SABG enforcement actions follow a similar pattern of sensitive-data and consent-mechanism scrutiny, and for independent verification of the specialised federal data-protection court system's commencement date and scope, which would clarify the judicial-review pathway available to parties affected by SABG decisions. Periodic update · new data 2026-10-11 #### Enforcement & Redress SABG fined the Federación Mexicana de Fútbol 42,849,095 Mexican pesos on 12 July 2026 for data-protection breaches connected to its FAN ID biometric registration system, finding that FMF had breached accountability and lawfulness principles by relying on a simple website checkbox to authorise both user registration and the collection of biometric data. This is the largest reported private-sector data-protection fine of the period under review and is a direct demonstration that SABG retains and is exercising active enforcement authority notwithstanding the change in institutional structure following INAI's dissolution. The maximum statutory fine available under Article 59 of the LFPDPPP is reported, through secondary commentary, as 320,000 UMA, understood to be approximately MXN 37,539,200 at a stated 2026 daily UMA value, doubling where sensitive personal data is involved; this figure has not been independently verified against the primary statutory text this cycle, and the FMF penalty of MXN 42,849,095 appears, on the reported figures, to approach or potentially exceed the unmultiplied maximum, consistent with the sensitive-data doubling provision given the biometric nature of the data at issue, though this specific reconciliation has not been confirmed against primary source. #### Outlook The FMF fine is the clearest available evidence that SABG's enforcement function is operationally active, which bears directly on the broader institutional-independence question raised by INAI's dissolution: an executive-branch successor agency can still impose significant penalties. Independent verification of the primary LFPDPPP Article 59 maximum-fine text remains an open item that would allow more precise reconciliation of the FMF penalty against the statutory ceiling. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 109 words · 17 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties