Mexico
Tier 3 Comprehensive law AmericasPrincipal framework: LFPDPPP 2025 (replacing the 2010 law) (2025). Regulator: Anti-Corruption & Good Governance Secretariat. A new LFPDPPP was enacted in March 2025 and the independent regulator INAI was abolished — oversight moved into the executive, raising independence questions for adequacy talks.
At a glance
- Principal law
- LFPDPPP 2025 (replacing the 2010 law)
- Regulator
- Anti-Corruption & Good Governance Secretariat
- Breach notification
- Notify the authority and affected persons without delay where significant harm
- Maximum penalty
- Substantial UMA-day-based fines under the 2025 law
- DPO required
- A data protection officer or department must be designated
- Digital consent age
- Parental consent for minors
- Extraterritorial reach
- Processing in Mexican territory or on behalf of Mexican controllers
Structure
- Structural pattern
- Pattern 3 — uniform private law, devolved public sector
- Sub-jurisdictions
- 0 (regulator-and-public-sector-only)
- ISO code
- MX
Transfers and adequacy
- EU member
- No
- EEA member
- No
Instruments
No instrument profiled yet.
Sources
No source recorded yet. This record cannot rise above Tier 3 until it has one — see depth tiers.
Never independently verified — seeded from the prototype.