Mexico

Article 199 Octies criminalises, for any person, divulging, sharing, distributing, or publishing images, videos, or audio of intimate sexual content of an adult without their consent, approval, or authorisation, and separately criminalises video-recording, audio-recording, photographing, printing, or producing such content of a person without their consent, approval, or authorisation, each carrying 3 to 6 years' imprisonment and a fine of 500 to 1,000 times the Unidad de Medida y Actualización (UMA).

Article 199 Nonies imposes the same penalties where the intimate sexual images, videos, or audio disseminated, shared, distributed, or published do not actually correspond to the person indicated or identified in them: the article's text requires only that the disseminated content not correspond to the identified person, without regard to how the non-corresponding depiction was produced, so it reaches a manipulated, fabricated, or AI-synthesised depiction of a person's face or voice in intimate sexual content on the same terms as any other non-corresponding depiction.

Article 199 Decies increases the minimum and maximum penalty by up to one half where the offence is committed by a spouse, partner, or person in a relationship of trust with the victim; by a public servant in the exercise of their functions; against a person unable to understand or resist the act; for non-lucrative benefit; for profit; or where the victim, as a consequence of the offence, attempts against their own physical integrity or life.

New Article 305 Bis of the Ley Federal del Trabajo requires a performing artist's labor contract to specifically stipulate the conditions and remuneration for using their image or voice through artificial intelligence systems or any other technology.

Reformed Article 87 of the Ley Federal del Derecho de Autor requires a performing artist's express consent, or that of their representative or rights-holder, before their image, including their voice, may be used or published, and expressly extends that protection to results generated by AI systems or other technology; a performer who received specific remuneration for a use is presumed to have consented only to the agreed purpose and modality, and any different use requires new authorisation and remuneration.

The article exempts use where the performer's image forms a minor part of a group, is captured in a public place, or is used for informational or journalistic purposes, and does not treat parody, satire, or creative imitation as a violation, nor a use that is not a cloning or impersonation intended to mislead the public or to substitute the performer's own professional work in the market through AI or another technology.

New Article 118, fracción VII, of the same law gives a performer a right against the impersonation of their interpretations by AI systems or other technology that generates clones of their interpretations or simulates their voice identifiably, subject to the same parody, satire, and non-replacement exceptions.

Article 121 requires a prior written agreement between the parties for any cloning or impersonation of a performer's voice or image using AI or other technology within an audiovisual work, beyond what a production contract ordinarily authorises. Article 231, fracción II, makes contravening Articles 87 or 118, fracción VII, an infraction, and Article 232 fixes the administrative fine for that infraction between 5,000 and 40,000 days of the general minimum wage.

Article 19 requires the responsable to inform the data subject immediately of a security breach occurring at any stage of processing personal data that significantly affects the data subject's patrimonial or moral rights, so the data subject can take the steps needed to defend their rights. The Law states no separate deadline measured in hours or days: immediacy of the breach itself is the period, and the duty runs to the affected data subject alone.

The Law states no duty to report a breach to the Secretaría; article 39 gives the Secretaría general investigative and sanctioning powers over compliance with this Law, but no provision requires a breach report to it specifically.

Article 1 protects personal data in the possession of private parties nationwide, excepting only credit-reporting societies and purely personal, non-commercial data collection. Article 5 requires lawfulness, purpose limitation, loyalty, consent, quality, proportionality, information and accountability in every processing, and article 6 bars collecting or processing personal data through deceptive or fraudulent means.

Article 7 conditions processing on the data subject's consent, express or tacit, except where article 9 dispenses with it (a legal provision, a publicly available source, prior dissociation, a legal relationship's requirements, an emergency, medical care, or a judicial order), and requires express consent specifically for financial or patrimonial data; consent is revocable at any time without retroactive effect.

Article 10 requires the responsable to keep personal data accurate, complete and current, to suppress it once its retention purpose lapses, and specifically to delete data relating to a contractual default once seventy-two months have passed from the date of the default. Article 11 limits processing to the purposes stated in the privacy notice and requires fresh consent for a different purpose.

Articles 14 to 17 require a privacy notice, made available at or before first collection, stating the responsable's identity and address, the categories of data collected (identifying which are sensitive), the purposes requiring consent, the data subject's options to limit use or disclosure, the ARCO mechanisms, and how notice changes will be communicated, in full or simplified form depending on the collection channel.

Article 18 requires administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized use, access or processing, at a level no lower than the responsable's own information-security measures. Article 20 requires everyone involved in any stage of processing to keep personal data confidential, an obligation that survives the end of their relationship with the responsable.

Article 37 lets responsables adopt binding self-regulation schemes, notified to the Secretaría, that complement the Law's duties. This statute states no registration, data-protection-impact-assessment, or data-protection-officer duty on the responsable.

Article 35 conditions any transfer of personal data to a national or foreign third party, other than the persona encargada, on communicating the privacy notice and the purposes to which the data subject's processing is subject; the notice must state whether the data subject accepts the transfer, and the recipient assumes the same duties as the transferring responsable.

Article 36 lists the grounds on which a domestic or international transfer may proceed without the data subject's consent: a law or treaty to which Mexico is a party, medical prevention, diagnosis, care, or health-service management, a transfer within a corporate group under common control operating under the same internal processes and policies, a contract concluded or to be concluded in the data subject's interest, a public-interest or judicial-administration ground, the recognition, exercise, or defense of a right in a judicial proceeding, or the maintenance or performance of a legal relationship between the responsable and the data subject.

The chapter treats domestic and cross-border transfers under the same regime rather than imposing a separate data-localization or adequacy-list requirement for transfers leaving Mexico.

Article 21 lets any data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection), none conditioning or blocking the others, and requires personal data to be safeguarded so these rights can be exercised without delay. Article 22 gives a right of access to the data subject's personal data and to the conditions of its processing through the privacy notice.

Article 23 gives a right to rectify or correct inaccurate, incomplete, or outdated personal data. Article 24 gives a right to cancel personal data from the responsable's files, records, and systems at any time, subject to a blocking period equal to the statute of limitations for the underlying legal relationship before the data is finally suppressed, with notice to the data subject once cancelled and to any third party the data were transferred to before the cancellation.

Article 25 lists the grounds on which the responsable need not cancel data (a contractual necessity, a legal requirement, an obstacle to judicial or administrative proceedings, the data subject's own protected interests, the public interest, a legal obligation of the data subject, or a health professional's care under a duty of secrecy).

Article 26 also gives a right to object to processing, or demand it cease, on a legitimate cause tied to the data subject's own specific situation that justifies that even lawful processing must stop to avoid causing them harm or prejudice; objection does not lie where processing is necessary to comply with a legal obligation imposed on the responsable. Articles 27 to 30 set the request's required content and require the responsable to designate a person or department to handle it.

Article 31 requires the responsable to communicate its determination within a maximum of twenty days of receiving an ARCO request, to give effect to a favourable determination within fifteen days of that communication, and lets both periods be extended once for an equal period on justified grounds.

Article 33 lists the grounds on which an ARCO request may be denied (inadequate identification, the data not being in the responsable's possession, a third party's rights, a legal impediment or an authority's ruling, or a request already carried out), each requiring written reasons.

Article 34 makes exercising ARCO rights free, limited to reproduction, copying, or shipping costs, and caps a repeat request within twelve months at three times the Unidad de Medida y Actualización absent a substantial change to the privacy notice.

Article 26, fracción II gives a data subject an unqualified right to object to processing, or demand that it cease, where their personal data is the object of a fully automated decision that produces undesired legal effects for them or significantly affects their interests, rights, or freedoms, and evaluates, without human intervention, personal aspects such as their professional performance, economic situation, health, sexual preferences, reliability, or behaviour.

The right sits alongside the other objection grounds of article 26 and shares that article's one carve-out: objection does not lie where the processing is necessary to comply with a legal obligation imposed on the responsable.

Article 76 obliges financial entities, money transmitters, credit information companies, the clearing houses of the Ley para la Transparencia y Ordenamiento de los Servicios Financieros, financial technology institutions and companies authorized to operate with novel models to establish standardized application programming interfaces that let their interfaces connect with each other and with specialized information technology third parties, to share open financial data, aggregated data and transactional data.

Transactional data are the clients' personal data and may be shared only with the clients' prior express authorization, and the information may be used only for the purposes the client strictly authorizes. The entities must interrupt access as soon as the client withdraws consent, vulnerabilities put client information at risk, or the third party breaches the agreed terms, and must notify the supervisory commissions or Banco de México of the interruption within two hours of detecting it.

The exchange is subject to provisions of general application that the supervisory commission, or Banco de México for credit information companies and clearing houses, issues, and access through the interfaces requires the prior authorization of those authorities. The entities must register with the commissions or Banco de México the consideration they charge for the exchange, at least thirty calendar days before a new or increased charge takes effect.

Article 28 allows a credit information company to give information to a user only when the client has given express authorization by signature, stating full knowledge of the nature and scope of the information, of the use the user will make of it and of the user's ability to run periodic checks of the credit history while the legal relationship lasts. The signature may be collected by hand or electronically on the terms Banco de México sets.

The authorization is required for individuals and for legal entities with total credits under 400,000 UDIS, and does not apply to information requested by Banco de México, the Comisión Nacional Bancaria y de Valores, courts in a proceeding where the client is a party or the accused, or the federal tax authorities acting through the Commission for tax, anti-money-laundering or counter-terrorist-financing purposes.

The authorization lasts one year from its grant, or up to two further years if the client expressly agrees, and in any case while the legal relationship between the user and the client lasts. Where the authorization text forms part of the paperwork a client signs for a service, it must sit in a special section and carry its own additional signature.

The company, its employees and officers are forbidden to supply clients' personal data for marketing products or services of users or third parties, except for credit-history queries, and doing so is the offence of revealing secrets under article 210 of the Código Penal Federal.

Article 40 gives a client the right to ask a credit information company for the client's Special Credit Report through the specialized units of the company, and requires the company to prepare it in clear, complete and accessible form and to send it or make it available within five business days of receiving the request.

The company must let the client choose between collecting the report at its specialized unit, receiving it by email, or receiving it in a sealed envelope with acknowledgement of receipt, and must keep a free telephone number and a website available for continuous consultation to take requests and claims.

Article 41 gives the client the right to ask for free delivery of the Special Credit Report each time twelve months have passed, provided the client asks for delivery by email or collects it at the specialized unit.

Article 42 lets a client who disagrees with the information in a Credit Report or Special Credit Report file a claim in writing, by mail, internet, telephone or email, requires the company to record claims made by telephone and to give the client a control number, and leaves the time for answering the claim to the provisions of general application Banco de México issues.

Article 38 charges the Secretaría with disseminating knowledge of the right to data protection, promoting its exercise, and overseeing compliance with the Law.

Article 39 gives the Secretaría the power to monitor and verify compliance, interpret the Law administratively, support responsables technically, issue criteria and recommendations, publish security standards and best practices, resolve rights-protection and verification proceedings and impose sanctions, cooperate with other supervisory authorities, and prepare privacy-impact studies before new processing modalities, among other functions.

Article 40 lets a data subject or representative file a rights-protection request with the Secretaría within fifteen days of the responsable's response, or after the response deadline lapses without one, when the responsable denies, ignores, or inadequately answers an ARCO request; the Secretaría gives the responsable fifteen days to answer, admits evidence, and allows five days for closing arguments.

Article 42 sets a maximum of fifty days to resolve the rights-protection request, extendable once for an equal period on justified cause. Article 43 gives the responsable ten days to give effect to a favourable resolution once notified. Article 45 lets the Secretaría cure deficiencies in the complaint without altering its original content. Article 46 lets the Secretaría dismiss the request, confirm, revoke, or modify the responsable's response, or order delivery of the data.

Article 49 lets the Secretaría seek conciliation between the parties at any point, with a binding written agreement closing the matter. Article 51 lets a party challenge a Secretaría resolution by amparo before specialized federal courts, and article 52 lets the Secretaría publish its resolutions with the data subject's identifying references removed.

Article 53 lets a data subject who suffered damage or injury from the responsable's or persona encargada's non-compliance pursue the compensation available under other applicable law.

Article 54 lets the Secretaría open a verification procedure on its own initiative or on request, and article 56 opens a sanctions procedure when a rights-protection or verification proceeding surfaces a suspected violation; article 57 gives the accused responsable fifteen days to submit evidence and five days for closing arguments, with a fifty-day resolution deadline extendable once for an equal period.

Article 58 lists nineteen infractions, from failing to satisfy an ARCO request without justified reason to processing personal data contrary to the Law's principles, creating a sensitive-data database without a justified purpose, and obstructing a verification act.

Article 59 fines an infraction from 100 to 160,000 times the Unidad de Medida y Actualización for the lesser infractions and 200 to 320,000 times the UMA for the more serious ones, adds 100 to 320,000 UMA for a repeated infraction, and lets sanctions for infractions involving sensitive personal data double.

Article 60 lists the factors the Secretaría weighs when it grounds a sanction: the nature of the data, how plainly unjustified the responsable's refusal was, intent, the responsable's economic capacity, and recidivism. Article 61 states that these administrative sanctions apply without prejudice to any resulting civil or criminal liability.

Articles 62 to 64 create criminal offences: three months to three years' imprisonment for a person authorized to process personal data who, for profit, causes a security breach of a database in their custody; six months to five years' imprisonment for anyone who processes personal data through deceit for undue profit, taking advantage of the data subject's or an authorized person's error; and double the penalty in either offence where the data processed is sensitive personal data.

Article 6 requires the authorization of the Federal Government to incorporate and operate as a credit information company. The Secretaría de Hacienda y Crédito Público grants it after hearing the opinion of Banco de México and of the Comisión Nacional Bancaria y de Valores, and the authorization cannot be transferred.

Article 2, fracción VI defines sensitive personal data as data touching the data subject's most intimate sphere, or whose misuse could cause discrimination or a serious risk to them, and lists, illustratively but not exhaustively, racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, political opinions, and sexual preference; the list does not name a biometric identifier, voiceprint, or faceprint, so a biometric identifier not otherwise tied to one of the enumerated categories is protected only as ordinary personal data under this Law's general regime.

Article 8 requires the data subject's express, written consent, given by autograph signature, electronic signature, or another authentication mechanism, before processing sensitive personal data, and bars creating a database of sensitive personal data unless its creation serves a legitimate, specific purpose consistent with the responsable's explicit activities or aims.

Article 12 requires the responsable to make reasonable efforts to limit the period sensitive personal data is processed to the minimum indispensable, on top of the general proportionality principle article 12 states for personal data generally.

Article 9, fracción VI separately lets a responsable process sensitive personal data without consent for medical prevention, diagnosis, care, or health-service management while the data subject cannot consent, carried out by someone bound by professional secrecy.

Article 211 bis 1 punishes with 6 months to 2 years' imprisonment and a fine anyone who, without authorisation, modifies, destroys, or causes the loss of information contained in a computer system or equipment protected by a security mechanism, and with 3 months to 1 year's imprisonment anyone who, without authorisation, learns of or copies such protected information.

Articles 211 bis 2 and 211 bis 3 impose heavier penalties, up to 10 years for public-security systems, for the same conduct against a State computer system, distinguishing an outsider acting without authorisation from an insider authorised to access the system who acts improperly within it. Articles 211 bis 4 and 211 bis 5 apply a parallel regime to financial-sector computer systems.

Article 211 bis 7 increases every penalty in the chapter by up to one half where the information obtained is used for the offender's own benefit or a third party's. Each offence turns on defeating a security mechanism protecting the system ("protegidos por algún mecanismo de seguridad") without authorisation; the text does not on its face reach reading a page that carries no such mechanism. The provisions this entry describes came into force on different days.

Article 114 Bis lets a copyright or related-right holder implement an effective technological protection measure, defined as any technology, device, or component that, in the normal course of its operation, protects the right or controls access to a work, performance, or phonogram, and lets rights-management information be attached to a work.

Article 232 Bis fines, from 1,000 to 20,000 times the Unidad de Medida y Actualización (UMA), anyone who produces, reproduces, manufactures, distributes, imports, markets, leases, stores, transports, offers, makes available, or otherwise supplies a device, mechanism, product, component, or system that is promoted, marketed, or advertised for the purpose of circumventing an effective technological protection measure; is used predominantly for that purpose; or is designed, produced, or executed for that purpose.

Neither article names crawling, scraping, or a bot as such; Article 232 Bis's prohibition runs against trafficking in a device or service designed to circumvent, and a separate provision, Article 232 Ter, fines the act of circumventing a technological protection measure that controls access to a copyrighted work, regardless of the collection method used afterward.

Article 107 protects a database or other machine-readable material as a compilation where its selection or arrangement of content constitutes an intellectual creation, and the protection does not extend to the underlying data and materials themselves. Article 108 separately protects a non-original database in its exclusive use by whoever compiled it, for 5 years, without requiring the originality Article 107 asks of a compilation.

Article 109 conditions access to, and publication, reproduction, disclosure, public communication, or transmission of, private information about identifiable people contained in such a database on the prior authorisation of the persons concerned, exempting law-enforcement investigations and lawful access to public archives.

Article 110 gives the holder of the patrimonial right over a database the exclusive right to authorise or prohibit its reproduction, translation, adaptation, reordering or other modification, distribution, and public communication, including of the results of a permitted modification. Mexico's regime protects the compilation's selection and arrangement and, separately, a 5-year producer-style exclusive-use right over a non-original database.

The Act was published in the Diario Oficial de la Federación on 24 December 1996, its first transitory article puts it in force ninety days after that publication, and no official source stating the resulting day has been located.

Article 168 Bis 11, section IX of the Comisión Nacional Bancaria y de Valores general provisions for credit institutions requires that information security incidents be handled through management processes covering detection, classification, containment, investigation, reporting, resolution, follow-up and communication to authorities, clients and counterparties.

Article 168 Bis 12, section II of those provisions requires security reviews of the technological infrastructure at least once a year, or sooner if the infrastructure changes significantly. Article 168 Bis 12, section III of those provisions requires an annual calendar of vulnerability-scanning tests, with quarterly review of some components so that every component holding critical information is covered within the year.

Article 168 Bis 12, section IV of those provisions requires the institution to hire an independent third party with certified technical staff to run penetration tests on its systems and applications. The Commission issued the provisions under articles 52 and 96 Bis of the Ley de Instituciones de Crédito. A breach of the provisions is punishable by an administrative fine the Commission imposes under article 108 of the Ley de Instituciones de Crédito.

The provisions were published in the Diario Oficial de la Federación on 28 January 2021. The provisions enter into force ninety calendar days after their publication. Article 31 of the provisions requires an electronic payment funds institution to have a Plan Director de Seguridad approved by its general director or sole administrator. Article 33 of the provisions requires an evaluation or audit of the security of the technological infrastructure at least once a year.

Article 34 of the provisions requires the institution to hire a legal entity with certified technical staff to run penetration tests on its systems and applications at least every two years. Article 35 of the provisions requires the institution to have a chief information security officer.

Article 56 of the Ley para Regular las Instituciones de Tecnología Financiera makes the use of electronic means and authentication subject to general provisions that the CNBV and Banco de México issue jointly for electronic payment funds institutions. Infractions of general provisions the CNBV issues alone or jointly with Banco de México that carry no specific sanction are fined 2,000 to 10,000 UMA under article 103, section XIV of that law.

Article 76 Bis opens the chapter: its rules apply to the relationship between a proveedor (provider) and a consumidor (consumer) in a transaction carried out through medios electronicos, opticos o de cualquier otra tecnologia. Fraccion I requires the provider to keep the consumer's information confidential and not disclose it to another provider outside the transaction without the consumer's express authorization or a competent authority's request.

Fraccion II requires the provider to use an available technical security element to give security and confidentiality to that information, and to tell the consumer, before the transaction closes, the general characteristics of that element.

Article 76 Bis 1 separately requires a provider that offers, commercializes or sells goods, products or services using those means to follow the Norma Mexicana the Secretaria de Economia issues for electronic commerce, which the article specifies must contain at least seven categories of information; fraccion V of that list is reliable technical security mechanisms guaranteeing the protection and confidentiality of the consumer's personal information and of the transaction itself.

Neither article names a sector, a company size or a data category; the duty runs to any provider transacting electronically with a consumer in Mexico.

Procuraduria Federal del Consumidor (PROFECO), the decentralized administrative authority the LFPC itself creates to protect consumer rights, enforces the statute; this chapter creates no distinct criminal offence and no separate private right of action beyond PROFECO's ordinary consumer-complaint and sanction procedures under the LFPC's general fine bands (Arts. 126 to 128 Bis, amounts adjusted annually by DOF accord and not restated here to avoid publishing a figure that goes stale before the next adjustment).

Article 168 Bis 16, section I of the general provisions for credit institutions requires the general director to make arrangements so that the Commission is told of information security incidents immediately, by email to its cybersecurity account with an electronic receipt.

The incidents that must be reported immediately are those that cause economic, data or service loss, whose method of operation can be replicated at other institutions, that can affect clients or the stability of the financial or payment system, or that the institution itself considers serious. Article 168 Bis 16, section I also requires the institution to send the information in Annexes 64 and 64 Bis within 5 business days of identifying the incident.

Article 168 Bis 16, section II requires an immediate investigation of the causes and a work plan sent to the Commission within 15 business days after the incident ends. Where sensitive information in the custody of the institution or its service providers was extracted, lost, deleted or altered, or unauthorized access is suspected, article 168 Bis 16 requires clients to be notified within 48 hours of the incident or of learning of it.

The Commission issued the provisions under articles 52 and 96 Bis of the Ley de Instituciones de Crédito. A breach of the provisions is punishable by an administrative fine the Commission imposes under article 108 of the Ley de Instituciones de Crédito.

The provisions were published in the Diario Oficial de la Federación on 28 January 2021. The provisions enter into force ninety calendar days after their publication. Article 42, section I of the provisions requires the general director or sole administrator to make arrangements so that Banco de México and the CNBV are told of information security incidents immediately, by email to designated accounts or other means they indicate.

Article 42, section I also requires the institution to send the information in Annexes 3 and 4 within five business days of identifying the incident. Article 42, section II requires an immediate investigation of the causes and a work plan sent to Banco de México and the CNBV within fifteen business days after the incident ends.

Where personal or sensitive information in the custody of the institution or its service providers was extracted, lost, deleted or altered, or unauthorized access is suspected, article 42, section III requires clients to be notified within twenty-four hours of the incident or of learning of it.

Article 56 of the Ley para Regular las Instituciones de Tecnología Financiera makes the use of electronic means and authentication subject to general provisions that the CNBV and Banco de México issue jointly for electronic payment funds institutions. Infractions of general provisions the CNBV issues alone or jointly with Banco de México that carry no specific sanction are fined 2,000 to 10,000 UMA under article 103, section XIV of that law.

Article 69 Bis requires the Secretaría de Gobernación to issue the guidelines classifying video games distributed, marketed, or rented by any means, and to oversee compliance. A video-game distributor must print or affix the applicable classification on the game's cover and in its advertising. A video-game marketer must not advertise, exhibit, sell, or rent a video game whose classification is not visible under the guidelines.

A video-game marketer or renter must require a person seeking to buy or rent a video game classified as exclusively for adults to prove they have reached the age of majority, without which the sale or rental may not proceed. Article 148, fracción VII Bis, makes contravening this duty an infraction, sanctioned under Article 149 with a fine of 3,000 to 30,000 days of the general minimum wage in effect when the conduct occurred, doubled on recidivism. The article itself does not specify a required proof-of-age method.

Article 148's chapeau permits using an already-divulged literary or artistic work, without the rightsholder's authorisation and without remuneration, provided the normal exploitation of the work is not affected, the source is always cited, and the work is not altered, only in the cases the article then lists. Fracción I permits quoting a text, provided the amount taken cannot be considered a simulated and substantial reproduction of the work's content.

Fracción II permits reproducing articles, photographs, illustrations, and commentary on current events, published by the press or broadcast by radio, television, or any other medium, unless the rightsholder has expressly prohibited that use. Fracción II's own permission is opt-out rather than opt-in: a news publisher who has not expressly prohibited the reuse cannot object to a reproduction that otherwise meets Article 148's conditions.

The Act was published in the Diario Oficial de la Federación on 24 December 1996, its first transitory article puts it in force ninety days after that publication, and no official source stating the resulting day has been located.