Your Jurisdiction at a Glance — Mexico
Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), new law in force since 21 March 2025
Authority: Secretariat of Anti-Corruption and Good Governance (SABG), which took over from the dissolved INAI
- Privacy notice (aviso de privacidad) is mandatory
- ARCO rights: access, rectification, cancellation and opposition
- Designated person or department to handle requests
- Data subjects must be informed of breaches that significantly affect their rights
- Task 2 of this workshop: document Mexico in the data protection scope document, together with sector rules and other countries you operate in
- Workshop 2: governance, roles and the data protection officer
- Workshop 3: records of processing activities
- Workshop 8 and 9: risk assessment and security measures
- Workshop 10: vendors, processors and international transfers
- Workshop 11: data breaches and notification deadlines