NEW FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES

On March 20, 2025, the New Federal Law on the Protection of Personal Data Held by Private Parties (the “New Law” or “NLFPDPPP”) was published in Mexico’s Official Federal Gazette. This new legislation addresses the challenges of today’s digital environment by introducing more robust and precise tools for regulating the processing of personal data by private-sector entities.

1. Key Changes.

The New Law introduces significant changes to the previous data protection framework, including the adoption of new key concepts and obligations for those handling personal data in the private sector. Among the most relevant modifications are, (i) changes to the structure and legal requirements of Privacy Notices, (ii) new rules regarding the Consent granted by data subjects, (iii) the introduction of ARCO Rights, and (iv) the introduction of the definition of Regulated Entities.

2. Effective Date and Recommended Actions.

The Federal Executive has 90 calendar days from March 20, 2025, to issue the regulations that will detail the procedures, oversight mechanisms, and possible exceptions contemplated by the New Law.

However, even though such regulations have not yet been published, the NLFPDPPP is already in force and compliance is mandatory.

In light of the above, regulated entities should begin taking the following actions:

  • Review and update internal policies and protocols regarding the processing of personal data;
  • Redesign and validate privacy notices in accordance with the new legal requirements;
  • Update contracts with data processors or service providers who have access to personal data; and
  • Assess current risks and strengthen the security measures in place.

3. Penalties for Non-Compliance.

Failure to comply with the obligations set forth in the New Law may result in significant consequences for organizations. Among the most notable sanctions are fines of up to 320,000 UMAs (currently over MXN$30,000,000.00), which may be doubled in cases of repeated violations or where the unlawful processing involves sensitive personal data.

For a more in-depth assessment of how these changes may affect your organization, and for legal guidance on compliance, please contact our Corporate Practice Group.

rodrigo.igareda@diazigareda.com
galina.hijar@diazigareda.com

Leave a Reply

Your email address will not be published. Required fields are marked *