MexicoLey Federal de Protección de Datos Personales en Posesión de los Particulares, security-breach notice
LFPDPPP, art. 19 (security-breach notice)
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify the affected data subject immediately of the breach, occurring at any stage of processing personal data, that significantly affects their patrimonial or moral rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
In English: the controller must immediately inform the data subject of any security breach, at any stage of processing, that significantly affects their patrimonial or moral rights, so that they can take steps to defend them. Article 19 is a duty to notify the data subject only. It asks for no register of breaches and no report to the Secretaría, and names no reader of a record. The article carries no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 19 requires the responsable to inform the data subject immediately of a security breach occurring at any stage of processing personal data that significantly affects the data subject's patrimonial or moral rights, so the data subject can take the steps needed to defend their rights. The Law states no separate deadline measured in hours or days: immediacy of the breach itself is the period, and the duty runs to the affected data subject alone.
The Law states no duty to report a breach to the Secretaría; article 39 gives the Secretaría general investigative and sanctioning powers over compliance with this Law, but no provision requires a breach report to it specifically.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .