Meet Mexico's LFPDPPP privacy duties with less manual effort

The LFPDPPP is Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. It regulates how private organisations collect, use, store and transfer personal data. A new version was published on 20 March 2025 and replaced the 2010 law the next day. It requires privacy notices, consent, security measures, breach notification to affected individuals and handling of access, rectification, cancellation and objection (ARCO) requests.

Private individuals and companies that process personal data in Mexico must comply with the LFPDPPP. This includes businesses handling customer, supplier or employee data. The law excludes credit information companies covered by their own legislation and people who collect and store data solely for personal use without disclosure or commercial purpose. Public bodies are covered by a separate general law.

The 2025 LFPDPPP keeps the main structure of the 2010 law but renumbers its articles and moves enforcement from the INAI, which was dissolved, to the Secretaría Anticorrupción y Buen Gobierno. It refines definitions such as consent, which must be free, specific and informed, and clarifies the scope of cancellation. Organisations should check privacy notices, consent and procedures against the new text.

The Secretaría can issue warnings and fines of 100 to 160,000 times the UMA for some infractions and 200 to 320,000 times the UMA for the most serious ones. Persistent infractions attract an additional fine, and amounts can be doubled where sensitive data is involved. Separately, the law sets criminal penalties of three months to five years in prison for certain misuse of personal data.

ARCO rights are the rights of Access, Rectification, Cancellation and Objection that individuals hold over their personal data under the LFPDPPP. Requests are free apart from reproduction or delivery costs. The organisation must communicate its decision within 20 days of receiving the request and, if the request is upheld, give effect to it within 15 days of that response.

Yes. Article 19 requires organisations to inform affected individuals immediately of security breaches at any stage of processing that significantly affect their property or moral rights, so they can protect themselves. Article 18 also requires administrative, technical and physical security measures, and Article 20 requires confidentiality controls for everyone involved in processing, which continue after the relationship ends.

The LFPDPPP shares many ideas with GDPR, such as transparency, purpose limitation, data quality, security and individual rights, but it has its own privacy notice rules, ARCO procedure and enforcement regime. ISO 27001 does not ensure compliance on its own, but a working information security management system supports the law's security, breach and confidentiality duties.

Yes. OneClickComply supports the LFPDPPP today, with its obligations mapped to controls covering privacy notices, consent, security measures, breach handling, ARCO requests and third-party transfers. Evidence is collected automatically from connected systems and reused across GDPR, LGPD and ISO 27001. OneClickComply helps you prepare and maintain compliance but does not certify you or guarantee compliance.