Data Protection 2025 – México

1 Relevant Legislation and Competent Authorities

1.1 What is the principal data protection legislation?

The legal framework for data protection is found in Articles 6 and 16 of the Mexican Constitution, as well as in the new Federal Law for the Protection of Personal Data Held by Private Parties, published on March 20, 2025, and its Regulations, published in December 2011 (hereinafter the "FLPPDHPP").

1.2 Is there any other general legislation that impacts data protection?

Yes: the New General Law for the Protection of Personal Data in the Possession of Obliged Subjects, also published on March 20, 2025, which regulates the processing of personal information ("PI") in the possession of any Federal, State or local governmental authorities ("the Law"); the Privacy Notice Rules, published in January 2013; the Binding SelfRegulation Parameters, also published in January 2013; and the General Guidelines for the Protection of Personal Data for the public sector