MexicoReglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares, security-breach notice
Reglamento de la LFPDPPP, arts. 63-66 (security-breach notice), DOF
In force since .
A breach notification rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Inform the data subject of a security breach that significantly affects their patrimonial or moral rights as soon as you confirm that it occurred and have started a thorough review of how far it reaches, without delay (art. 64).
- Tell the data subject at least the nature of the incident, the personal data compromised, your recommendations on the steps the data subject can take to protect their interests, the corrective actions already taken, and where to get more information (art. 65).
- After a breach, analyze its causes and put corrective, preventive and improvement actions in place to adjust your security measures so that it does not repeat (art. 66).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
In English: the Reglamento has the controller tell the data subject, without delay, of a breach that significantly affects their patrimonial or moral rights, and say at least what happened, what data was compromised, what the data subject can do, what was done at once and where to learn more. Article 66 asks for an analysis of causes and corrective actions. None of the three articles asks for a register of breaches or a report to the authority, and none names a reader of a record. They carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 64 requires the responsable to inform the data subject of a security breach that significantly affects the data subject's patrimonial or moral rights as soon as the responsable confirms that the breach occurred, without delay, so that the data subject can take the corresponding measures.
Article 65 sets the minimum content of that notice: the nature of the incident, the personal data compromised, recommendations to the data subject, the corrective actions already taken and where to get more information. Article 66 requires the responsable to analyze the causes of a breach and implement corrective, preventive and improvement actions so that it does not repeat.
The Cámara de Diputados publishes the Reglamento as current text (TEXTO VIGENTE), and it entered into force the day after its publication in the Diario Oficial de la Federación on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .