MexicoLey Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)
Ley Federal de Proteccion al Consumidor (LFPC) Capitulo VIII Bis "De los Derechos de los Consumidores en las Transacciones Efectuadas a traves del Uso de Medios Electronicos, Opticos o de Cualquier Otra Tecnologia", Arts. 76 Bis y 76 Bis 1, capitulo adicionado por decreto publicado en el Diario Oficial de la Federacion el 29 de mayo de 2000, texto vigente con ultima reforma DOF 14-11-2025
In force since .
A security baseline statutes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Enforcement body
- Procuraduria Federal del Consumidor (PROFECO)
- Obligation class
- Security, Disclosure
What it requires
- Where you offer, market or sell goods, products or services to a consumer in Mexico through electronic, optical or other technological means, keep the information that consumer gives you confidential, and do not disclose or transmit it to another provider outside the transaction without the consumer's express authorization or a competent authority's request.NIST CSF 2.0PR.DS-01
- Use an available technical security element to give security and confidentiality to that consumer information, and tell the consumer, before the transaction closes, the general characteristics of that element.NIST CSF 2.0PR.DS-01
- Follow the Secretaria de Economia's Norma Mexicana for electronic commerce, which requires among other things reliable technical security mechanisms that guarantee the protection and confidentiality of the consumer's personal information and of the transaction itself.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
What this law does
Article 76 Bis opens the chapter: its rules apply to the relationship between a proveedor (provider) and a consumidor (consumer) in a transaction carried out through medios electronicos, opticos o de cualquier otra tecnologia. Fraccion I requires the provider to keep the consumer's information confidential and not disclose it to another provider outside the transaction without the consumer's express authorization or a competent authority's request.
Fraccion II requires the provider to use an available technical security element to give security and confidentiality to that information, and to tell the consumer, before the transaction closes, the general characteristics of that element.
Article 76 Bis 1 separately requires a provider that offers, commercializes or sells goods, products or services using those means to follow the Norma Mexicana the Secretaria de Economia issues for electronic commerce, which the article specifies must contain at least seven categories of information; fraccion V of that list is reliable technical security mechanisms guaranteeing the protection and confidentiality of the consumer's personal information and of the transaction itself.
Neither article names a sector, a company size or a data category; the duty runs to any provider transacting electronically with a consumer in Mexico.
Procuraduria Federal del Consumidor (PROFECO), the decentralized administrative authority the LFPC itself creates to protect consumer rights, enforces the statute; this chapter creates no distinct criminal offence and no separate private right of action beyond PROFECO's ordinary consumer-complaint and sanction procedures under the LFPC's general fine bands (Arts. 126 to 128 Bis, amounts adjusted annually by DOF accord and not restated here to avoid publishing a figure that goes stale before the next adjustment).
When LexLint raises it
When your app profile says your app distributes a software product, ships a mobile app, operates an app store, operates a social platform, deploys a chatbot, sends automated outreach, reuses other publishers' content, generates content with AI, serves under-18s, processes biometric data, processes voice recordings, makes high-risk automated decisions or publishes adult content.
Back to the example · Lint your app
Page updated .