Processes personal data, in Mexico

Reglamento de la LFPDPPP, arts. 63-66 (security-breach notice), DOF 21 December 2011 · Read the law's page

• Inform the data subject of a security breach that significantly affects their patrimonial or moral rights as soon as you confirm that it occurred and have started a thorough review of how far it reaches, without delay (art. 64).
• Tell the data subject at least the nature of the incident, the personal data compromised, your recommendations on the steps the data subject can take to protect their interests, the corrective actions already taken, and where to get more information (art. 65).
• After a breach, analyze its causes and put corrective, preventive and improvement actions in place to adjust your security measures so that it does not repeat (art. 66).

Reglamento de la LFPDPPP, arts. 74-76 (international transfers), DOF 21 December 2011 · Read the law's page

• Transfer personal data abroad only when the recipient assumes the same obligations that apply to you as the responsable that transferred the data (art. 74).
• Where you transfer data abroad, you may use contractual clauses or other legal instruments that provide at least the same obligations that bind you and the conditions on which the data subject consented to the processing (art. 75).

LFPDPPP, art. 19 (security-breach notice) · Read the law's page

• Notify the affected data subject immediately of the breach, occurring at any stage of processing personal data, that significantly affects their patrimonial or moral rights.

LFPDPPP, arts. 2(VI), 8 and 12 (sensitive personal data) · Read the law's page

• Obtain the data subject's express, written consent, by autograph signature, electronic signature, or another authentication mechanism, before processing their sensitive personal data, unless a statutory exception applies.
• Do not create a database of sensitive personal data unless its creation serves a legitimate, specific purpose consistent with your explicit activities or aims.
• Make reasonable efforts to limit the period you process sensitive personal data to the minimum indispensable for the purpose.

LFPDPPP, arts. 21-34 (ARCO rights and their exercise) · Read the law's page

• Let a data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection) at any time, without requiring one as a precondition of another, and safeguard their personal data so these rights can be exercised without delay.
• Communicate your determination on an ARCO request within twenty days of receiving it, give effect to a favourable determination within fifteen days of communicating it, and put any denial in writing with the reasons.
• Do not charge for exercising ARCO rights beyond the cost of reproduction, copying, or shipping, and cap the cost of a repeat request within twelve months at three times the Unidad de Medida y Actualización unless the privacy notice changed substantially.

LFPDPPP, arts. 35-36 (transfer of personal data) · Read the law's page

• Before transferring personal data to a national or foreign third party, other than a persona encargada, communicate the privacy notice and the purposes of the processing to the recipient, and state in the notice whether the data subject accepts the transfer.
• Do not transfer personal data without the data subject's consent unless a listed Article 36 ground applies, such as a legal or treaty basis, a transfer within a corporate group under common control, or a ground necessary to a contract or legal relationship with the data subject.
• Bind the recipient of a transfer to the same data-protection duties that apply to you as the transferring responsable.

LFPDPPP, arts. 38-64 (Secretaría, rights-protection procedure, verification, sanctions and offences) · Read the law's page

• Answer a rights-protection request the Secretaría serves on you within fifteen days, offering the evidence and arguments you rely on.
• Give effect to a resolution favourable to the data subject within ten days of its notification, or the longer period the resolution itself sets.
• Expect an infraction of the Law to draw a fine of 100 to 320,000 times the Unidad de Medida y Actualización, doubled where the personal data at issue is sensitive, on top of a repeat-infraction surcharge.
• Expect a security breach you cause for profit, or personal data you process through deceit for undue profit, to carry criminal liability of up to five years' imprisonment, doubled in either case for sensitive personal data.
• Expect a data subject harmed by your non-compliance with this Law to be able to pursue compensation under the applicable civil-liability law, independent of any administrative or criminal sanction.

Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Nueva Ley publicada en el Diario Oficial de la Federación el 20 de marzo de 2025, última reforma DOF 14-11-2025, arts. 1-7, 9-18, 20 and 37 (scope, principles, consent, notice, security and confidentiality, self-regulation) · Read the law's page

• Obtain the data subject's consent, express or tacit, before processing their personal data, unless a listed statutory exception applies, and treat consent for financial or patrimonial data as requiring express consent.
• Give the data subject a privacy notice, at or before the first collection of their personal data, stating your identity and address, the categories of data collected and which are sensitive, the purposes that require consent, the options to limit use or disclosure, the ARCO mechanisms, and how you will communicate any change to the notice.
• Limit processing of personal data to the purposes stated in the privacy notice, and obtain the data subject's consent again before processing it for a different purpose.
• Establish and maintain administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, at a level no lower than the measures you keep for your own information.
• Require everyone who takes part in any stage of processing personal data to keep it confidential, an obligation that survives the end of their relationship with you.
• Delete personal data relating to a contractual default once seventy-two months have passed from the date the default occurred, and otherwise suppress personal data, after any blocking period, once it is no longer necessary for the purposes stated in the privacy notice.

LRITF, art. 76 (open finance interfaces) · Read the law's page

• If you are a financial entity, money transmitter, credit information company, clearing house, financial technology institution or company authorized to operate with novel models, establish standardized application programming interfaces that let your interfaces connect with other such entities and with specialized information technology third parties, to share open financial data, aggregated data and transactional data (art. 76).
• Share transactional data, which are the clients' personal data, only with the client's prior express authorization, and use the information shared only for the purposes the client strictly authorized (art. 76).
• Interrupt access to client information as soon as the client withdraws consent, vulnerabilities put the information at risk, or the third party breaches the agreed terms, and notify the supervisory commission or Banco de México of the interruption within two hours of detecting it (art. 76).
• If you are a third party seeking access through the interfaces, obtain the prior authorization of the supervisory commission or, for credit information companies and clearing houses, Banco de México (art. 76).
• Register with the supervisory commission or Banco de México the consideration you charge for the data exchange, at least thirty calendar days before a new or increased charge takes effect (art. 76).

LRSIC, art. 28 (signed authorization for disclosure) · Read the law's page

• If you are a credit information company, give information to a user only when the client has given express authorization by signature, stating that the client knows the nature and scope of the information, the use the user will make of it, and that the user may run periodic checks of the credit history while the legal relationship lasts (art. 28).
• Collect the client's signature by hand or electronically on the terms Banco de México sets, and obtain the authorization for individuals and for legal entities with total credits under 400,000 UDIS (art. 28).
• If you are a user, do not rely on an authorization beyond one year from its grant, or up to two further years if the client expressly agrees, except for as long as a legal relationship with the client lasts (art. 28).
• Put an authorization text that forms part of the paperwork for a service in a special section, with the client's handwritten signature as an additional signature (art. 28).
• Do not supply a client's personal data to a user or any third party for marketing products or services, except for credit-history queries (art. 28).

LRSIC, art. 6 (authorization to operate) · Read the law's page

• Do not incorporate or operate as a credit information company without the authorization of the Federal Government, which the Secretaría de Hacienda y Crédito Público grants after hearing Banco de México and the Comisión Nacional Bancaria y de Valores, and which cannot be transferred (art. 6).

LRSIC, arts. 40-42 (special credit report and claims) · Read the law's page

• If you are a credit information company, formulate the Special Credit Report a client requests in clear, complete and accessible form, and send it or make it available within five business days of receiving the request, at the client's choice at your specialized unit, by email, or in a sealed envelope with acknowledgement of receipt (art. 40).
• Send a client the Special Credit Report free of charge each time twelve months have passed, when the client asks for delivery by email or collects it at your specialized unit (art. 41).
• Keep a free telephone number and a website available for continuous consultation to take Special Credit Report requests and clients' claims, and answer clients' questions about them (art. 40).
• Accept a client's claim about the information in a Credit Report or Special Credit Report in writing, by mail, internet, telephone or email, record claims made by telephone, and give the client a control number to follow the claim (art. 42).
• If you are a financial entity, Sofome E.N.R. or commercial company that supplies or queries credit information, process the Special Credit Report requests clients present through your specialized unit or the persons you designate, and tell clients the free telephone number (art. 40).