MexicoLey Federal de Protección de Datos Personales en Posesión de los Particulares, transfer of personal data
LFPDPPP, arts. 35-36 (transfer of personal data)
In force since .
A cross border transfer rule binding private bodies.
- Obligation class
- Transfer, Disclosure
- Audit expectation
- none
What it requires
- Before transferring personal data to a national or foreign third party, other than a persona encargada, communicate the privacy notice and the purposes of the processing to the recipient, and state in the notice whether the data subject accepts the transfer.NIST Privacy FrameworkCM.AW-P1
- Do not transfer personal data without the data subject's consent unless a listed Article 36 ground applies, such as a legal or treaty basis, a transfer within a corporate group under common control, or a ground necessary to a contract or legal relationship with the data subject.NIST Privacy FrameworkCT.PO-P2
- Bind the recipient of a transfer to the same data-protection duties that apply to you as the transferring responsable.NIST Privacy FrameworkID.DE-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
In English: a controller that intends to transfer personal data to national or foreign third parties other than its processor must give them the privacy notice and the purposes to which the data subject limited the processing. Article 35 also has the notice carry a clause saying whether the data subject accepts the transfer, and Article 36 lists the transfers that need no consent. Neither article asks the controller to keep or show a record of transfers or of the data subject's answer, and neither names a log or a reader of one. They carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 35 conditions any transfer of personal data to a national or foreign third party, other than the persona encargada, on communicating the privacy notice and the purposes to which the data subject's processing is subject; the notice must state whether the data subject accepts the transfer, and the recipient assumes the same duties as the transferring responsable.
Article 36 lists the grounds on which a domestic or international transfer may proceed without the data subject's consent: a law or treaty to which Mexico is a party, medical prevention, diagnosis, care, or health-service management, a transfer within a corporate group under common control operating under the same internal processes and policies, a contract concluded or to be concluded in the data subject's interest, a public-interest or judicial-administration ground, the recognition, exercise, or defense of a right in a judicial proceeding, or the maintenance or performance of a legal relationship between the responsable and the data subject.
The chapter treats domestic and cross-border transfers under the same regime rather than imposing a separate data-localization or adequacy-list requirement for transfers leaving Mexico.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .