Data protection & privacy law in Mexico (2026)
Data protection in Mexico: comprehensive law.
Mexico maintains a comprehensive, GDPR-style data-protection regime grounded in the constitutional rights to privacy and informational self-determination. A wholly new LFPDPPP for the private sector took effect on 21 March 2025, repealing the 2010 law, alongside a reformed General Law (LGPDPPSO) for public-sector entities. The 2024-2025 constitutional reform abolished the independent regulator INAI and transferred data-protection oversight to the executive's Secretariat of Anti-Corruption and Good Governance.
Legal framework
Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), published in the Diario Oficial de la Federación on 20 March 2025; complemented by the General Law on Protection of Personal Data Held by Obligated Subjects (LGPDPPSO) for the public sector. Supervisory authority: Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).
Key points: data & privacy in Mexico
New comprehensive private-sector law (2025)
A brand-new LFPDPPP was published in the DOF on 20 March 2025 and entered into force on 21 March 2025, repealing the 2010 statute of the same name. It regulates the legitimate, controlled and informed processing of personal data held by private parties.
Supervisory authority replaced INAI
A constitutional reform published 28 November 2024 dissolved the autonomous regulator INAI. Data-protection enforcement and oversight now sit with the executive's Secretariat of Anti-Corruption and Good Governance, with judicial review available via amparo before specialized district courts.
ARCO data-subject rights
Individuals retain ARCO rights, Access, Rectification, Cancellation and Opposition, over their personal data; the right of Cancellation is now explicitly extended to the systems and records where data is stored.
Core controller obligations
Controllers must provide a clear privacy notice (aviso de privacidad) at collection, obtain consent (generally free, specific and informed, with tacit consent valid as a rule), adopt security measures, ensure confidentiality, manage retention/deletion, and notify data breaches.
Cross-border transfers
Transfers abroad are permitted where the destination ensures adequate protection or the data subject consents; the transferor must ensure recipients uphold the same confidentiality and security standards as set out in the privacy notice.
Separate public-sector regime
The General Law on Protection of Personal Data Held by Obligated Subjects (LGPDPPSO) covers public authorities across the executive, legislative and judicial branches, autonomous bodies, political parties and the states/municipalities; it was likewise reformed via the 20 March 2025 decree (with further reform published 14 November 2025).
Timeline of decisions
- GuidanceSABG Begins Stakeholder Consultations on Implementing Regulations for 2025 Data Laws
The Secretariat of Anti-Corruption and Good Governance (SABG) launched industry and civil-society dialogues in January 2026 to draft secondary regulations for the new data protection framework. As of mid-2026 no revised regulations have been published in the Official Gazette, leaving significant compliance gaps unresolved.
Chambers & Partners Data Protection & Privacy 2026
- LawSpecialized Data Protection Court (30th Judicial Circuit, Aguascalientes) Becomes Operational
A new specialized federal court began adjudicating all data-protection rights disputes, replacing INAI's quasi-judicial function. This was the final element of the March 2025 institutional overhaul, channeling all pending and new ARCO-rights litigation to a single federal circuit.
Greenberg Traurig
- Decision · officialINAI Formally Dissolved; Data-Protection Oversight Moves to SABG
The Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) is formally extinguished and its personal-data-protection functions transferred to the new Secretaría Anticorrupción y Buen Gobierno. The dissolution ends Mexico's independent data-protection regulator, the principal body that had overseen AI-adjacent personal-data processing under the LFPDPPP and LGPDPPSO.
Diario Oficial de la Federación
- Law · officialNew LFPDPPP Enacted, INAI Formally Extinguished
A wholly revised Federal Law on Protection of Personal Data Held by Private Parties was published in the DOF, repealing the 2010 statute and transferring data-protection enforcement from the dissolved INAI to the Secretariat of Anti-Corruption and Good Governance. The reform expands who counts as a 'data controller,' imposes direct obligations on processors, and mandates security-incident notification, but critics warn the loss of an independent enforcement authority undermines effective oversight.
Diario Oficial de la Federación
- LawNew LFPDPPP and General Public-Sector Data Law Enacted; INAI Formally Abolished
A single decree published in the Official Gazette enacted a rewritten Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and a new General Law on Protection of Personal Data Held by Obligated Subjects (public sector), both effective 21 March 2025. The reform abolished INAI, transferred enforcement to SABG, and introduced mandatory data-processor obligations, stricter granular-consent rules, and explicit regulation of automated decision-making.
White & Case
- EnforcementINAI Opens Sanctions Procedure Against Mexican Football Federation Over Fan ID Biometrics
In one of its final major cases before dissolution, INAI initiated formal sanctioning proceedings against the Federación Mexicana de Fútbol concerning the Fan ID app's collection of biometric and personal data from stadium attendees without adequate consent. The case highlighted persistent enforcement gaps around biometric data and proportionality.
ICLG Data Protection Laws & Regulations 2025–2026
- LawConstitutional 'Organic Simplification' Reform Published, INAI Abolished
The constitutional decree extinguishing INAI and six other autonomous bodies was published in the DOF, ending 14 years of independent data-protection supervision and concentrating all enforcement within the executive branch. Privacy advocates warned the reform eliminated the structural independence required to effectively sanction government entities for cybersecurity and data breaches.
BASHAM (reporting DOF decree of 20 Dec 2024)
- LawConstitutional Reform Abolishing INAI Enters into Force
A constitutional reform eliminating INAI and six other autonomous regulatory bodies takes effect, removing the independent watchdog that enforced data-protection rights applicable to commercial AI systems. Promoted by the ruling Morena party, the reform shifts oversight to executive-branch bodies, raising concerns about AI accountability.
Infobae
- LawConstitutional 'Organic Simplification' Reform Dissolving INAI Published in Official Gazette
President Claudia Sheinbaum signed a constitutional reform eliminating seven autonomous bodies, including INAI, with data-protection provisions effective 23 December 2024. Congress was given 90 days to enact enabling legislation transferring INAI's functions to executive ministries, ending a decade of independent data-protection oversight and drawing sharp criticism from transparency advocates.
Chambers & Partners
- Law · officialLGPDPPSO Enacted, Public-Sector Data Protection and Security Obligations
The General Law on Protection of Personal Data Held by Obligated Subjects extended data-protection and minimum-security requirements to all government bodies, requiring agencies to implement technical and administrative safeguards, appoint data-protection officers, and report security incidents to INAI. It created a unified framework with the private-sector LFPDPPP, closing a major gap that left government-held data unprotected.
Cámara de Diputados
- Law · officialGeneral Law on Personal Data Protection for Public Bodies (LGPDPPSO) Enacted
Congress enacted the Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados, extending data-protection rights and obligations to government entities and granting INAI oversight authority over public-sector data processing. The law established the legal baseline governing automated and AI-driven personal data processing by government actors.
Cámara de Diputados
- LawGeneral Law on Personal Data Protection for the Public Sector (LGPDPPSO) Published
The LGPDPPSO extended full data-protection obligations, ARCO rights, data minimization, purpose limitation, security measures, and data-processor agreements, to all government bodies at federal, state, and municipal levels for the first time. It also introduced data portability in the public sector and designated INAI as the national supervisory authority across both public and private domains.
Creel, García-Cuéllar, Aiza y Enríquez
- Decision · officialSupreme Court Upholds Mandatory 24-Month ISP Data Retention
The Second Chamber of the Suprema Corte de Justicia de la Nación (SCJN) dismissed an amparo challenge to Article 189 of the LFTR, confirming that telecommunications carriers and ISPs must retain users' communications metadata for 24 months and make it accessible to security authorities on request; privacy advocates said the ruling normalised warrantless mass-surveillance infrastructure.
Suprema Corte de Justicia de la Nación (SCJN)
- LawConstitutional Reform Elevates IFAI to Autonomous INAI, Mexico's Independent Data Authority
A constitutional amendment transformed the Federal Institute for Access to Information (IFAI) into the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), granting it full constitutional autonomy: its own budget, commissioners with fixed non-removable terms, and decisions binding on all federal entities. This was the high-water mark of independent data-protection governance in Mexico.
Wikipedia — INAI
- GuidanceRegulation of the LFPDPPP Published, Operationalizing the 2010 Law
The implementing regulation, effective 22 December 2011, specified detailed requirements for privacy notices, consent mechanics, data-security standards, cross-border transfer procedures, and how controllers must respond to ARCO-rights requests. It provided the practical compliance rulebook that companies needed to give effect to the 2010 statute.
Baker McKenzie InsightPlus
- Law · officialFederal Law on Personal Data Protection (LFPDPPP) Enacted
Mexico's first comprehensive private-sector data-protection statute was published in the DOF, applying OECD fair-information principles to private-party data processors, establishing IFAI (later renamed INAI) as the supervisory authority, and granting individuals ARCO rights (access, rectification, cancellation, objection); it made Mexico among the first Latin American countries to adopt a standalone data-protection law.
Cámara de Diputados (Ley publicada en DOF)
- Law · officialLFPDPPP Enacted, Mexico's Foundational Data-Protection and Cybersecurity Compliance Law
The Federal Law on Protection of Personal Data Held by Private Parties was published in the DOF, establishing Mexico's first comprehensive data-protection regime: consent requirements, ARCO rights, mandatory security-breach notification, and minimum technical and administrative security measures for private entities processing personal data. For 15 years it was the primary legal basis for cybersecurity obligations on private-sector organisations and the statute enforced by INAI.
Cámara de Diputados
- Law · officialFederal Law on Personal Data Protection Held by Private Parties (LFPDPPP) Published
Mexico's first comprehensive data-protection statute was published in the Diario Oficial de la Federación, creating ARCO rights (access, rectification, cancellation, opposition), consent requirements, and INAI as the enforcement authority over private-sector data controllers. For over a decade it served as the primary legal constraint on commercial AI systems processing personal data.
Diario Oficial de la Federación
- LawLFPDPPP, Mexico's First Private-Sector Data Protection Law, Published in Official Gazette
The Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published 5 July 2010 and effective 6 July, created Mexico's foundational private-sector data-protection regime. It established ARCO rights (access, rectification, cancellation, objection), mandatory privacy notices, consent requirements, and the IFAI as enforcement authority for all private organizations processing personal data in Mexico.
IAPP (DOF Official Text, 5 July 2010)
- Law · officialConstitutional Amendment Enshrines Personal Data Protection as Fundamental Right (Articles 16 & 73)
Reforms to Articles 16 and 73 of the Political Constitution of the United Mexican States explicitly recognized data protection as a fundamental autonomous right, separate from privacy, and empowered Congress to legislate on private-sector data processing. This constitutional foundation was the direct legal basis for the 2010 LFPDPPP and all subsequent data protection legislation.
APEC Privacy Information Report — Mexico (2022)
- Law · officialFederal Transparency Law (LFTAIPG) Signed; IFAI Established as Mexico's First Data Oversight Body
President Vicente Fox signed the Federal Law on Transparency and Access to Public Government Information, creating the Federal Institute for Access to Information (IFAI), Mexico's first independent data-oversight institution, initially focused on government transparency. IFAI later became the primary enforcer of the 2010 private-sector data protection law, making this the origin point of Mexico's modern data governance architecture.
Organization of American States (OAS)
Sources
- diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf
- diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf
- diputados.gob.mx/LeyesBiblio/ref/lgpdppso.htm
- dof.gob.mx/nota_detalle.php?codigo=5752569&fecha=20/03/2025
- whitecase.com/insight-alert/mexico-enacts-new-data-protection-regime
- gtlaw.com/en/insights/2025/3/nueva-ley-general-proteccion-de-datos
- hoganlovells.com/en/publications/mexicos-new-federal-data-protection-law-what-it-means
- cookieyes.com/blog/mexico-data-privacy-law-lfpdppp/
- basham.com.mx/en/nueva-ley-federal-de-proteccion-de-datos-personales-en-posesion-de
Next for Mexico: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 23 May 2026. Methodology & how to cite · State of Technology Regulation 2026