Mexico Data Protection & Privacy Regulation

Lawful Processing & Special Data

The core lawful-processing standard under the Federal Law on Protection of Personal Data Held by Private Parties, in force since 21 March 2025, conditions all processing of personal data on consent given freely, specifically and in an informed manner, under Article 7 of the statute. This standard has not changed in its basic formulation from the prior regime, but its practical application has been reinforced by a related tightening: analysis of the reformed law indicates that any modification or addition to the purposes stated in a controller's privacy notice will require renewed consent from the data subject, closing a gap that previously allowed some purpose drift without a fresh consent event.

For sensitive personal data, Article 8 sets a materially higher bar than the general consent standard. Processing of sensitive categories requires express written consent, which may be evidenced by a physical signature, an electronic signature, or another authentication mechanism recognised under the law, and the statute separately prohibits the creation of databases of sensitive personal data without legitimate justification for doing so. This dual structure, a general freely-specific-informed standard alongside a heightened express-written-consent requirement for sensitive categories, places Mexico's lawful-processing architecture within a recognisably rigorous consent-based model, though the underlying sourcing for the sensitive-data provision rests on a single secondary legal-analysis source and is accordingly held at the probable rather than confirmed tier.

The purpose-limitation tightening, requiring fresh consent on any purpose modification, has a direct practical effect on controllers who update privacy notices to reflect new processing activities, data-sharing arrangements, or product features: each such change now carries its own consent-renewal obligation rather than being absorbed under a previously broader notice.

Outlook

No further legislative change to the lawful-processing or special-category framework is reported as pending. The practical test of the tightened purpose-limitation rule will be how consistently controllers across sectors implement renewed-consent mechanisms when privacy notices change, a question the sourcing does not allow an answer to. The sensitive-data consent requirement's interaction with the institutional uncertainty noted elsewhere, regarding SABG's enforcement authority, remains a relevant consideration for assessing how rigorously Article 8 will in practice be supervised.

Algorithmic, Biometric & Surveillance Governance

SABG's FAN ID enforcement decision against the Mexican Football Federation is the clearest confirmation to date that biometric data is treated as sensitive personal data under Mexico's data-protection framework, requiring both explicit identification as sensitive in a controller's privacy notice and a heightened consent standard beyond simple checkbox acknowledgment. The FAN ID programme itself involved biometric identity verification, a category of processing that sits squarely within the algorithmic and biometric governance space given its use for identity-matching and verification purposes at scale, likely across a large number of football spectators or participants.

The scale of the resulting fine — 42,849,095 Mexican pesos, approximately 2.14 million US dollars — and its description as one of the most significant data-protection enforcement actions in Mexico to date, signals that biometric identity-verification programmes of this kind now carry materially elevated compliance risk in Mexico. For any organization deploying biometric identity-verification technology at scale in Mexico, including for event access, security or authentication purposes, the FAN ID decision establishes a concrete enforcement benchmark: the mere technical accuracy or security of a biometric system does not satisfy compliance obligations if the privacy notice fails to classify the data as sensitive and if consent is obtained through a mechanism the regulator considers inadequate for sensitive-category processing.

Outlook

Organizations operating biometric identity-verification systems in Mexico should expect continued SABG scrutiny of consent mechanisms and privacy-notice classifications following this precedent-setting action; watch for whether SABG pursues further biometric-processing enforcement actions against other sectors beyond sports and event-access use cases.

Enforcement & Redress

The maximum administrative fine under Mexico's private-sector data-protection law remains set at 320,000 units of measure and update (UMA), equivalent to approximately 37.5 million Mexican pesos at 2026 UMA values. The unit of measurement has changed over time, from a prior basis tied to minimum-wage days to the current UMA-based calculation, but the nominal multiplier underlying the ceiling is reported as unchanged. This figure rests on a single secondary compliance-sector source and is held at the probable tier with medium translation confidence on the specific peso-equivalent conversion.

The more structurally significant enforcement development is institutional rather than numeric. Because SABG, the body now responsible for private-sector data-protection oversight, is an executive-branch ministry rather than a constitutionally autonomous body of the kind INAI was, data subjects and controllers no longer have access to the independent, tribunal-style review process that INAI formerly provided. This finding is assessed at the probable confidence tier and is treated, consistent with the interpreter's own key judgment, as a material degradation of enforcement credibility: a nominally unchanged or even tightened fine ceiling carries materially different practical weight when the body empowered to impose it lacks the independence from executive-branch direction that its predecessor held. Whether SABG retains any formal sanctioning or adjudicative power at all under the new statutory arrangement, as distinct from a purely dissemination and promotion role, has not been confirmed against primary statutory text and stands as an open verification gap.

The combination of these two findings, an unchanged penalty ceiling paired with a materially weakened independent-review mechanism, is the central enforcement-and-redress story for Mexico: the formal numbers have not moved, but the institutional path by which those numbers would be applied, contested, or reviewed has changed in a way that reduces the credibility of the regime as previously understood.

Outlook

Resolving whether SABG holds genuine sanctioning authority, or only a dissemination and promotion function, is the single highest-priority open question for this module going forward, and until it is resolved against primary statutory text, any assessment of Mexico's practical enforcement posture should be treated as provisional. The loss of an autonomous tribunal-style review mechanism is likely to remain the defining enforcement-and-redress characteristic of the Mexican regime for the foreseeable period, independent of whatever administrative penalty figures remain formally on the books.

Enforcement & Redress

On 12 July 2026, Mexico's Secretaría Anticorrupción y Buen Gobierno (SABG) imposed a fine of 42,849,095 Mexican pesos, approximately 2.14 million US dollars, against the Federación Mexicana de Futbol Asociación over its FAN ID biometric data processing programme. This is reported as the first published sanction under the 2025 LFPDPPP framework and is described as one of the most significant data-protection enforcement actions in Mexico to date. The decision found two distinct failures: the federation did not flag photographs as sensitive data in its privacy notice, and it obtained consent through an inadequate checkbox mechanism, rather than a mechanism meeting the heightened standard required for sensitive-category processing.

Separately, secondary commentary describes an amparo-based judicial review pathway for SABG's private-sector data-protection decisions, reportedly consolidated into specialised federal data-protection district courts that handle ARCO-rights litigation within a single federal circuit. This commentary was sourced from a lower-tier secondary source, and the exact commencement date and operational scope of these specialised courts was not independently verified, so this element should be treated as probable rather than confirmed pending primary-source verification.

Taken together, the FAN ID fine represents a concrete test case for Mexico's new enforcement architecture under SABG: a record-scale sanction, issued by an executive-branch body rather than an autonomous authority, for a clearly articulated set of sensitive-data and consent failures. The scale and specificity of the decision suggest SABG intends to establish enforcement credibility notwithstanding the institutional-independence question raised by INAI's dissolution.

Outlook

Watch for whether further SABG enforcement actions follow a similar pattern of sensitive-data and consent-mechanism scrutiny, and for independent verification of the specialised federal data-protection court system's commencement date and scope, which would clarify the judicial-review pathway available to parties affected by SABG decisions.

Enforcement & Redress

On 12 July 2026, Mexico's Secretaría Anticorrupción y Buen Gobierno (SABG) imposed a fine of 42,849,095 Mexican pesos, approximately 2.14 million US dollars, against the Federación Mexicana de Futbol Asociación over its FAN ID biometric data processing programme. This is reported as the first published sanction under the 2025 LFPDPPP framework and is described as one of the most significant data-protection enforcement actions in Mexico to date. The decision found two distinct failures: the federation did not flag photographs as sensitive data in its privacy notice, and it obtained consent through an inadequate checkbox mechanism, rather than a mechanism meeting the heightened standard required for sensitive-category processing.

Separately, secondary commentary describes an amparo-based judicial review pathway for SABG's private-sector data-protection decisions, reportedly consolidated into specialised federal data-protection district courts that handle ARCO-rights litigation within a single federal circuit. This commentary was sourced from a lower-tier secondary source, and the exact commencement date and operational scope of these specialised courts was not independently verified this cycle, so this element should be treated as probable rather than confirmed pending primary-source verification.

Taken together, the FAN ID fine represents a concrete test case for Mexico's new enforcement architecture under SABG: a record-scale sanction, issued by an executive-branch body rather than an autonomous authority, for a clearly articulated set of sensitive-data and consent failures. The scale and specificity of the decision suggest SABG intends to establish enforcement credibility notwithstanding the institutional-independence question raised by INAI's dissolution.

Outlook

Watch for whether further SABG enforcement actions follow a similar pattern of sensitive-data and consent-mechanism scrutiny, and for independent verification of the specialised federal data-protection court system's commencement date and scope, which would clarify the judicial-review pathway available to parties affected by SABG decisions.

Enforcement & Redress

SABG fined the Federación Mexicana de Fútbol 42,849,095 Mexican pesos on 12 July 2026 for data-protection breaches connected to its FAN ID biometric registration system, finding that FMF had breached accountability and lawfulness principles by relying on a simple website checkbox to authorise both user registration and the collection of biometric data. This is the largest reported private-sector data-protection fine of the period under review and is a direct demonstration that SABG retains and is exercising active enforcement authority notwithstanding the change in institutional structure following INAI's dissolution.

The maximum statutory fine available under Article 59 of the LFPDPPP is reported, through secondary commentary, as 320,000 UMA, understood to be approximately MXN 37,539,200 at a stated 2026 daily UMA value, doubling where sensitive personal data is involved; this figure has not been independently verified against the primary statutory text this cycle, and the FMF penalty of MXN 42,849,095 appears, on the reported figures, to approach or potentially exceed the unmultiplied maximum, consistent with the sensitive-data doubling provision given the biometric nature of the data at issue, though this specific reconciliation has not been confirmed against primary source.

Outlook

The FMF fine is the clearest available evidence that SABG's enforcement function is operationally active, which bears directly on the broader institutional-independence question raised by INAI's dissolution: an executive-branch successor agency can still impose significant penalties. Independent verification of the primary LFPDPPP Article 59 maximum-fine text remains an open item that would allow more precise reconciliation of the FMF penalty against the statutory ceiling.