Don’t do SECURITY. Do business SECURELY.
Request a consultation
Back to all insights

Mexico’s new private sector data protection law comes into force

Mexico’s new LFPDPPP comes into force, replacing the 2010 law and transferring regulatory functions.

Mexico’s new Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) comes into force today, replacing the 2010 law following constitutional reforms that abolished the former regulator.

Key points

  • Functions of the former regulator INAI move to the Ministry of Anti-Corruption and Good Governance.
  • Administrative, technical and physical security measures remain required.
  • Data subjects must be informed without delay of significant breaches.
  • Existing privacy notices need review.

UK organisations with Mexican operations, customers or employees should review their privacy notices, security measures and breach procedures against the new law.

Source: Ley Federal de Protección de Datos Personales en Posesión de los Particulares 2025 (Cámara de Diputados)

Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.

How we can help: consulting, auditing, and AI governance. Request a complimentary consultation.

More insights