On 20 March 2025 Mexico published a new Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) in the Official Gazette (DOF), replacing the 2010 law. At the same time, the National Institute for Transparency (INAI) was dissolved. In 2026 the new structure is in operation — and the new authority is making its presence felt.
The New Law in Brief
The new LFPDPPP keeps the familiar foundations — privacy notices, ARCO rights (access, rectification, cancellation and opposition) and the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability. Notable changes include:
- A new supervisory authority instead of INAI (see below)
- Changes to the privacy notice requirements, including the information that must be given on data transfers
- Tacit consent as the general rule, with express consent still required where the law demands it, for example for sensitive data
- Challenges to the authority's decisions through amparo proceedings before specialised courts
Implementing regulations for the new law are still expected; until then, companies should follow the law itself and watch for official publications in the DOF.
The Secretaría Anticorrupción y Buen Gobierno
Supervision, verification and sanctioning powers for the private sector now sit with the Secretaría Anticorrupción y Buen Gobierno (SABG), a ministry of the federal executive, through its personal data protection unit. Unlike INAI, it is not an autonomous body — but it has broad powers to monitor compliance, resolve rights protection proceedings and impose fines.
Enforcement in 2026
Reports from the SABG in 2026 show that enforcement is real:
- According to figures presented by the SABG, 51 private parties were sanctioned for data protection violations, with fines totalling around 118.5 million pesos
- Verification proceedings — both ex officio and following complaints — have increased significantly in 2026
- In September 2026 the SABG announced an investigation into databases with more than 12.9 million records offered on a messaging platform, using its monitoring and verification powers under the LFPDPPP
Fines are calculated in UMA units and can be doubled where sensitive data is involved.
Your 2026 Checklist
- Update your privacy notices to the new law and remove outdated references to INAI
- Review your consent model: where is tacit consent enough, and where do you still need express consent?
- Test your ARCO process, including deadlines and identity verification
- Strengthen security and prepare for data breaches — leaks of customer data are a clear enforcement focus
- Prepare for verification: keep your documentation ready to show the SABG
How ResGuard Can Help
The ResGuard Data Protection Manager manages ARCO requests, privacy notices, processing records and incidents in Spanish. Our outsourced DPO service for Mexico helps you adapt to the new law.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: LFPDPPP published in the DOF on 20 March 2025, SABG announcements and press reports on its 2026 enforcement figures.