MexicoLey Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)
Ley Federal de Protección de Datos Personales en Posesión de los Particulares Nueva Ley publicada en el Diario Oficial de la Federación el 20 de marzo de 2025, última reforma DOF 14-11-2025, arts. 1-7, 9-18, 20 and 37 (scope, principles, consent, notice, security and confidentiality, self-regulation)
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Consent, Disclosure, Security, Retention, Governance
- Audit expectation
- none
What it requires
- Obtain the data subject's consent, express or tacit, before processing their personal data, unless a listed statutory exception applies, and treat consent for financial or patrimonial data as requiring express consent.NIST Privacy FrameworkCT.PO-P1
- Give the data subject a privacy notice, at or before the first collection of their personal data, stating your identity and address, the categories of data collected and which are sensitive, the purposes that require consent, the options to limit use or disclosure, the ARCO mechanisms, and how you will communicate any change to the notice.NIST Privacy FrameworkCM.AW-P1
- Limit processing of personal data to the purposes stated in the privacy notice, and obtain the data subject's consent again before processing it for a different purpose.NIST Privacy FrameworkGV.PO-P1
- Establish and maintain administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, at a level no lower than the measures you keep for your own information.NIST Privacy FrameworkPR.DS-P5
- Require everyone who takes part in any stage of processing personal data to keep it confidential, an obligation that survives the end of their relationship with you.NIST Privacy FrameworkPR.PO-P9
- Delete personal data relating to a contractual default once seventy-two months have passed from the date the default occurred, and otherwise suppress personal data, after any blocking period, once it is no longer necessary for the purposes stated in the privacy notice.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
In English: every controller must establish and maintain administrative, technical and physical security measures that protect personal data against damage, loss, alteration, destruction and unauthorized use, access or processing. Articles 1 to 7, 9 to 18, 20 and 37 set principles, consent, notice, security, confidentiality and self-regulation without naming a log, register or kept record, or a reader of one; Article 13 asks only for "necessary and sufficient" measures and Article 20 for confidentiality controls. Article 1 declares the Law of general observance throughout the national territory but names no establishment, targeting or residence test, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 1 protects personal data in the possession of private parties nationwide, excepting only credit-reporting societies and purely personal, non-commercial data collection. Article 5 requires lawfulness, purpose limitation, loyalty, consent, quality, proportionality, information and accountability in every processing, and article 6 bars collecting or processing personal data through deceptive or fraudulent means.
Article 7 conditions processing on the data subject's consent, express or tacit, except where article 9 dispenses with it (a legal provision, a publicly available source, prior dissociation, a legal relationship's requirements, an emergency, medical care, or a judicial order), and requires express consent specifically for financial or patrimonial data; consent is revocable at any time without retroactive effect.
Article 10 requires the responsable to keep personal data accurate, complete and current, to suppress it once its retention purpose lapses, and specifically to delete data relating to a contractual default once seventy-two months have passed from the date of the default. Article 11 limits processing to the purposes stated in the privacy notice and requires fresh consent for a different purpose.
Articles 14 to 17 require a privacy notice, made available at or before first collection, stating the responsable's identity and address, the categories of data collected (identifying which are sensitive), the purposes requiring consent, the data subject's options to limit use or disclosure, the ARCO mechanisms, and how notice changes will be communicated, in full or simplified form depending on the collection channel.
Article 18 requires administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized use, access or processing, at a level no lower than the responsable's own information-security measures. Article 20 requires everyone involved in any stage of processing to keep personal data confidential, an obligation that survives the end of their relationship with the responsable.
Article 37 lets responsables adopt binding self-regulation schemes, notified to the Secretaría, that complement the Law's duties. This statute states no registration, data-protection-impact-assessment, or data-protection-officer duty on the responsable.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .