Mexico replaced its 2010 data protection law on 21 March 2025. The new law broadens the definition of personal data, adds a right to object to automated processing and raises fines. The independent regulator INAI was dissolved, and supervision moved to the Ministry of Anticorruption and Good Governance.
Privacy notices remain the centrepiece of Mexican compliance and must separate mandatory and voluntary purposes.
- Core data law
- Federal Law on the Protection of Personal Data Held by Private Parties (2025)
- In force
- 21 Mar 2025
- Regulator
- Ministry of Anticorruption and Good Governance
- Notices
- Integral, simplified and short privacy notices
- New right
- Object to automated processing
- Courts
- Specialised data protection courts
Who needs to comply
Private companies processing personal data in Mexico
The law applies to private parties processing personal data in Mexico, including through Mexican establishments or means.
The laws, in detail
01Federal Law on the Protection of Personal Data Held by Private Parties
Notices, consent, ARCO rights, security, transfers and sanctions.
When it applies
Processing personal data by private parties in Mexico.
What you must do
- Privacy notice listing data and separating mandatory from voluntary purposes
- Consent, express for sensitive and financial data
- ARCO rights: access, rectification, cancellation, opposition
- Right to object to automated decisions
- Security measures and breach notification to data subjects
Regulator
Ministry of Anticorruption and Good Governance
Penalties
Fines based on multiples of the UMA, doubled for sensitive data.
02Fintech Law (Ley Fintech) 2018
Authorisation of financial technology institutions and innovation models.
When it applies
Crowdfunding platforms and electronic payment fund institutions operating in Mexico.
What you must do
- Obtain CNBV authorisation before operating
- Information security and anti-money-laundering controls
- Customer disclosures and risk warnings
Regulator
CNBV; Banco de México
Penalties
Fines and operating restrictions.
03Federal Consumer Protection Law
Consumer rights, online sales, advertising and marketing registries.
When it applies
Businesses selling to consumers in Mexico.
What you must do
- Clear pricing and terms for online sales
- Respect the REPEP do-not-call/marketing registry
- Truthful advertising
Regulator
PROFECO
Penalties
Fines and orders.
04Anti-money laundering law (vulnerable activities)
AML duties for vulnerable activities, including virtual assets.
When it applies
Businesses offering virtual asset exchange and other vulnerable activities.
What you must do
- Register with the SAT for vulnerable activities
- Identify clients and file notices
- Keep records
Regulator
SHCP / SAT
Penalties
Fines and criminal penalties.
Compliance checklist
01 · Before you launch
- Spanish privacy notices (integral and short)
- Consent flows for sensitive and financial data
02 · At launch
- ARCO rights process
- Breach notification to individuals
03 · As you scale
- Automated decision opt-outs
- Transfer clauses with recipients
Key dates
- Jul 2010Original data protection law
- 21 Mar 2025New law in force; INAI dissolved
Common mistakes
- Reusing an old INAI-era notice
- Bundling voluntary purposes with mandatory ones
FAQs
Who enforces Mexico’s data law now?
The Ministry of Anticorruption and Good Governance, after INAI was dissolved in 2025.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.