Your system stores customer or employee data: what does Mexico's 2025 data protection law require?
By the Stonework team · Updated · 8 min read · Versión en español
Short answer
If your business stores personal data about customers or employees, Mexico's 2025 data protection law makes you the controller; the provider that runs your system is the processor, which handles the data on your behalf (art. 2). You must give a privacy notice, keep security measures in place, notify affected people immediately after a breach and answer their requests within 20 business days (arts. 15 to 19 and 31). Fines range from 100 to 320,000 UMA (the reference unit Mexican law uses to set fines), between $11,731 and $37,539,200 MXN in 2026, and can be increased up to two times when sensitive data such as health data is involved (art. 59).
Who has enforced the law since 2025
The Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) was published as a new law on March 20, 2025.
It appeared in Mexico's official gazette (Diario Oficial de la Federación, DOF) and repealed the 2010 law. Its latest amendment is from November 14, 2025.
INAI, the national transparency and data protection institute, used to handle data protection matters. Those matters moved to the Ministry of Anticorruption and Good Government (Secretaría Anticorrupción y Buen Gobierno).
The legal basis is art. 2, section XV, and the tenth transitional article. The Ministry verifies compliance with the law, resolves proceedings and imposes fines (art. 39).
In January 2026 the Ministry said it had opened 20 investigations into possible personal data breaches at government agencies and private parties.
You are the controller; your provider is the processor
The law covers any processing of personal data, whether manual or automated (art. 2, section XIX). It makes no difference whether you keep the data today in a system, in Excel or on paper.
| Role | Who it is in your case | What the law says |
|---|---|---|
| Data subject (persona titular) | Your customer, your patient, your employee | The person the data belongs to (art. 2, section XVIII) |
| Controller (responsable) | Your business | A private individual or legal entity that processes personal data (art. 2, sections XIV and XVI) |
| Processor (persona encargada) | The provider that builds, hosts or runs your system | Processes personal data on behalf of the controller (art. 2, section XII) |
You cannot hand off the responsibility. You must make sure that third parties you have a legal relationship with also respect your privacy notice (art. 13). And everyone involved must keep the data confidential, even after the relationship ends (art. 20).
The law does not require a specific contract with the processor. Put it in writing anyway: that the provider uses the data only for your system, what measures protect it, that it tells you about any breach, and that when the work ends it hands the data back to you and deletes it.
The same contract is where you settle who owns the source code.
What the law requires, obligation by obligation
| Obligation | Article | What it means in practice |
|---|---|---|
| Privacy notice | 15 and 16 | Six minimum elements: who you are and your address, what data you process and which of it is sensitive, for what purpose, how to limit its use, how to exercise ARCO rights and how you will announce changes. If you collect data electronically, you give a simplified version that says where to read the full notice |
| Consent for sensitive data | 8 | Express and in writing, with a handwritten signature, an electronic signature or another authentication mechanism. Health status, ethnic origin, beliefs and sexual preference are sensitive data (art. 2, section VI) |
| Security measures | 18 | Administrative, technical and physical, based on risk, and never weaker than the ones you use for your own information |
| Breach notification | 19 | If a breach significantly affects people's economic or moral rights, you notify them immediately |
| Confidentiality | 20 | For everyone who processes the data, also after the relationship ends |
| ARCO rights | 21 to 26 and 29 | Access, rectification, cancellation and opposition. You designate a person or a department to handle requests |
Deadlines for ARCO rights
ARCO stands for the four rights anyone can exercise over their data: access, rectification, cancellation and opposition. Under the law, days are business days (art. 2, section VIII).
- You have 20 days from receiving the request to communicate your response (art. 31).
- If the request is granted, you carry it out within the 15 days after that response (art. 31).
- These deadlines can be extended once, for an equal period, if the circumstances justify it (art. 31).
- It is free. You can only charge for reproduction, copies or shipping; if the same person repeats the request within twelve months, the charge cannot exceed three UMA (Unidad de Medida y Actualización), $351.93 MXN in 2026 (art. 34).
Cancellation does not mean deleting right away. First you block the data: you keep it without using it during the limitation period, and then you delete it (art. 24).
Cancellation does not apply in some cases, such as a legal obligation or a contract with that person (art. 25).
What your system must allow
The law does not mention software features. This table translates each obligation into what you need to handle it without searching by hand through ten files.
| To handle | Your system must let you |
|---|---|
| Access (art. 22) | Export to a file everything it stores about a person: records, notes and attachments |
| Rectification (art. 23) | Correct data and keep a record of who changed it and when |
| Cancellation (art. 24) | Block a person's data so no one uses it and, when the period ends, delete it |
| Opposition (art. 26) | Exclude a person from a specific use, such as promotional messages |
| Privacy notice (art. 16) | Show the simplified notice wherever data is captured, with a link to the full one, and store which version each person accepted |
| Sensitive data (art. 8) | Store proof of each person's express consent |
| Security (art. 18) | Permissions by role, an access log, encryption and backups that get tested |
| Breaches (art. 19) | Know which people an incident affected so you can notify them |
| Deadlines (art. 31) | Record each request with the date it was received |
The access log records who viewed or changed what, and when. The law does not name it, but without one it is very hard to know whom to notify after a breach.
Ask your provider how long it keeps backups. Data you deleted can still sit in a backup copy weeks later.
What the fines cost in 2026
Fines are set in UMA, the reference unit Mexican law uses for these amounts. In 2026 one UMA is worth $117.31 MXN per day, in effect since February 1, according to INEGI, Mexico's national statistics institute. Amounts below are in Mexican pesos (MXN).
| Violation (art. 58) | Examples | Fine (art. 59) | In 2026 pesos |
|---|---|---|---|
| Section I | Failing to handle an ARCO request without a justified reason | Warning | No fine; disobeying the warning is fined (section VII) |
| Sections II to VII | Negligence with requests, an incomplete privacy notice, inaccurate data left uncorrected | 100 to 160,000 UMA | $11,731 to $18,769,600 |
| Sections VIII to XVIII | Breaking confidentiality, a security breach attributable to you, collecting sensitive data without express consent | 200 to 320,000 UMA | $23,462 to $37,539,200 |
| Section IV of art. 59 | The violations above persist repeatedly | Additional fine of 100 to 320,000 UMA | $11,731 to $37,539,200 more |
With sensitive data, the amounts can be increased up to two times (art. 59). To set the fine, the Ministry weighs the nature of the data, whether there was intent, your economic capacity and repeat offenses (art. 60).
There are also crimes. Anyone authorized to process data who, for profit, causes a breach of the databases in their custody can face three months to three years in prison (art. 62). With sensitive data, the penalty doubles (art. 64).
When you do not need a new system for this
The law does not require a system. If you use commercial software that already lets you export and delete a person's data, what you are missing is probably not software: it is the privacy notice, someone to handle requests and a contract with your provider.
Building or adjusting a system makes sense when a person's data is scattered across Excel, WhatsApp and folders, and answering an access request would take you days. For the budget, see what custom software costs in Mexico.
If you run a clinic, also check what NOM 024, Mexico's official standard for electronic health records, requires.
Frequently asked questions
- Do I need a privacy notice if I only store names and phone numbers?
- Yes. Any information about an identified or identifiable person is personal data (art. 2, section V), and you make the notice available from the moment you collect the data (art. 2, section I, and art. 16).
- Who is responsible if my provider gets hacked?
- To the people affected, you are the controller: you must notify them immediately (art. 19). If the breach is attributable to you, the fine can reach 320,000 UMA (arts. 58 and 59), which is why the contract should state what measures your provider takes.
- Do I have to delete the data if a customer asks me to?
- First you block it during the limitation period and then you delete it (art. 24). This does not apply, for example, if you need the data to meet a legal obligation or a contract with that person (art. 25).
- Does INAI still handle data protection for companies?
- No. Personal data proceedings moved to the Ministry of Anticorruption and Good Government (Secretaría Anticorrupción y Buen Gobierno), which verifies compliance and imposes fines (art. 39 and tenth transitional article).
Sources
Most sources are Mexican laws and providers, published in Spanish.
- Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 de marzo de 2025, última reforma 14 de noviembre de 2025). Cámara de Diputados.
- Unidad de Medida y Actualización 2026, comunicado de prensa 1/26. INEGI, 8 de enero de 2026.
- Secretaría Anticorrupción confirma 20 investigaciones por la vulneración de datos personales en dependencias y particulares. Latinus, 12 de enero de 2026.
Notice. This guide explains the law in general terms, based on the current texts it cites. It is not legal or tax advice and does not replace a lawyer or an accountant who knows your case.
How we make these guides. Every figure has its source and its date; what has no source does not go in, and illustrative examples are labeled as such. We review them before publishing, every three months and whenever something they cite changes. These English versions are translations of our Spanish guides.
When this guide is reviewed. When the regulations for the 2025 law or guidelines from the Ministry of Anticorruption and Good Government are published, when INEGI publishes the 2027 UMA, or when the law is amended.
Who writes it. The Stonework team, a software studio in Mexico City that builds and runs EventQR, CuentaFácil and Conto, and builds custom software for companies.