MexicoLey Federal de Protección de Datos Personales en Posesión de los Particulares, ARCO rights
LFPDPPP, arts. 21-34 (ARCO rights and their exercise)
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Let a data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection) at any time, without requiring one as a precondition of another, and safeguard their personal data so these rights can be exercised without delay.
- Communicate your determination on an ARCO request within twenty days of receiving it, give effect to a favourable determination within fifteen days of communicating it, and put any denial in writing with the reasons.
- Do not charge for exercising ARCO rights beyond the cost of reproduction, copying, or shipping, and cap the cost of a repeat request within twelve months at three times the Unidad de Medida y Actualización unless the privacy notice changed substantially.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
In English: the controller must tell the data subject, within twenty days of receiving an ARCO request, what it has decided. Articles 21 to 34 set the access, rectification, cancellation and objection rights and the reply, refusal and fee rules; Article 24 keeps cancelled data in a blocked state for the limitation period, which limits the personal data and is not a log. The articles name no log, register or reader of one, and they carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 21 lets any data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection), none conditioning or blocking the others, and requires personal data to be safeguarded so these rights can be exercised without delay. Article 22 gives a right of access to the data subject's personal data and to the conditions of its processing through the privacy notice.
Article 23 gives a right to rectify or correct inaccurate, incomplete, or outdated personal data. Article 24 gives a right to cancel personal data from the responsable's files, records, and systems at any time, subject to a blocking period equal to the statute of limitations for the underlying legal relationship before the data is finally suppressed, with notice to the data subject once cancelled and to any third party the data were transferred to before the cancellation.
Article 25 lists the grounds on which the responsable need not cancel data (a contractual necessity, a legal requirement, an obstacle to judicial or administrative proceedings, the data subject's own protected interests, the public interest, a legal obligation of the data subject, or a health professional's care under a duty of secrecy).
Article 26 also gives a right to object to processing, or demand it cease, on a legitimate cause tied to the data subject's own specific situation that justifies that even lawful processing must stop to avoid causing them harm or prejudice; objection does not lie where processing is necessary to comply with a legal obligation imposed on the responsable. Articles 27 to 30 set the request's required content and require the responsable to designate a person or department to handle it.
Article 31 requires the responsable to communicate its determination within a maximum of twenty days of receiving an ARCO request, to give effect to a favourable determination within fifteen days of that communication, and lets both periods be extended once for an equal period on justified grounds.
Article 33 lists the grounds on which an ARCO request may be denied (inadequate identification, the data not being in the responsable's possession, a third party's rights, a legal impediment or an authority's ruling, or a request already carried out), each requiring written reasons.
Article 34 makes exercising ARCO rights free, limited to reproduction, copying, or shipping costs, and caps a repeat request within twelve months at three times the Unidad de Medida y Actualización absent a substantial change to the privacy notice.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .