Mexico

Article 199 Octies criminalises, for any person, divulging, sharing, distributing, or publishing images, videos, or audio of intimate sexual content of an adult without their consent, approval, or authorisation, and separately criminalises video-recording, audio-recording, photographing, printing, or producing such content of a person without their consent, approval, or authorisation, each carrying 3 to 6 years' imprisonment and a fine of 500 to 1,000 times the Unidad de Medida y Actualización (UMA).

Article 199 Nonies imposes the same penalties where the intimate sexual images, videos, or audio disseminated, shared, distributed, or published do not actually correspond to the person indicated or identified in them: the article's text requires only that the disseminated content not correspond to the identified person, without regard to how the non-corresponding depiction was produced, so it reaches a manipulated, fabricated, or AI-synthesised depiction of a person's face or voice in intimate sexual content on the same terms as any other non-corresponding depiction.

Article 199 Decies increases the minimum and maximum penalty by up to one half where the offence is committed by a spouse, partner, or person in a relationship of trust with the victim; by a public servant in the exercise of their functions; against a person unable to understand or resist the act; for non-lucrative benefit; for profit; or where the victim, as a consequence of the offence, attempts against their own physical integrity or life.

New Article 305 Bis of the Ley Federal del Trabajo requires a performing artist's labor contract to specifically stipulate the conditions and remuneration for using their image or voice through artificial intelligence systems or any other technology.

Reformed Article 87 of the Ley Federal del Derecho de Autor requires a performing artist's express consent, or that of their representative or rights-holder, before their image, including their voice, may be used or published, and expressly extends that protection to results generated by AI systems or other technology; a performer who received specific remuneration for a use is presumed to have consented only to the agreed purpose and modality, and any different use requires new authorisation and remuneration.

The article exempts use where the performer's image forms a minor part of a group, is captured in a public place, or is used for informational or journalistic purposes, and does not treat parody, satire, or creative imitation as a violation, nor a use that is not a cloning or impersonation intended to mislead the public or to substitute the performer's own professional work in the market through AI or another technology.

New Article 118, fracción VII, of the same law gives a performer a right against the impersonation of their interpretations by AI systems or other technology that generates clones of their interpretations or simulates their voice identifiably, subject to the same parody, satire, and non-replacement exceptions.

Article 121 requires a prior written agreement between the parties for any cloning or impersonation of a performer's voice or image using AI or other technology within an audiovisual work, beyond what a production contract ordinarily authorises. Article 231, fracción II, makes contravening Articles 87 or 118, fracción VII, an infraction, and Article 232 fixes the administrative fine for that infraction between 5,000 and 40,000 days of the general minimum wage.

Article 19 requires the responsable to inform the data subject immediately of a security breach occurring at any stage of processing personal data that significantly affects the data subject's patrimonial or moral rights, so the data subject can take the steps needed to defend their rights. The Law states no separate deadline measured in hours or days: immediacy of the breach itself is the period, and the duty runs to the affected data subject alone.

The Law states no duty to report a breach to the Secretaría; article 39 gives the Secretaría general investigative and sanctioning powers over compliance with this Law, but no provision requires a breach report to it specifically.

Article 1 protects personal data in the possession of private parties nationwide, excepting only credit-reporting societies and purely personal, non-commercial data collection. Article 5 requires lawfulness, purpose limitation, loyalty, consent, quality, proportionality, information and accountability in every processing, and article 6 bars collecting or processing personal data through deceptive or fraudulent means.

Article 7 conditions processing on the data subject's consent, express or tacit, except where article 9 dispenses with it (a legal provision, a publicly available source, prior dissociation, a legal relationship's requirements, an emergency, medical care, or a judicial order), and requires express consent specifically for financial or patrimonial data; consent is revocable at any time without retroactive effect.

Article 10 requires the responsable to keep personal data accurate, complete and current, to suppress it once its retention purpose lapses, and specifically to delete data relating to a contractual default once seventy-two months have passed from the date of the default. Article 11 limits processing to the purposes stated in the privacy notice and requires fresh consent for a different purpose.

Articles 14 to 17 require a privacy notice, made available at or before first collection, stating the responsable's identity and address, the categories of data collected (identifying which are sensitive), the purposes requiring consent, the data subject's options to limit use or disclosure, the ARCO mechanisms, and how notice changes will be communicated, in full or simplified form depending on the collection channel.

Article 18 requires administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized use, access or processing, at a level no lower than the responsable's own information-security measures. Article 20 requires everyone involved in any stage of processing to keep personal data confidential, an obligation that survives the end of their relationship with the responsable.

Article 37 lets responsables adopt binding self-regulation schemes, notified to the Secretaría, that complement the Law's duties. This statute states no registration, data-protection-impact-assessment, or data-protection-officer duty on the responsable.

Article 35 conditions any transfer of personal data to a national or foreign third party, other than the persona encargada, on communicating the privacy notice and the purposes to which the data subject's processing is subject; the notice must state whether the data subject accepts the transfer, and the recipient assumes the same duties as the transferring responsable.

Article 36 lists the grounds on which a domestic or international transfer may proceed without the data subject's consent: a law or treaty to which Mexico is a party, medical prevention, diagnosis, care, or health-service management, a transfer within a corporate group under common control operating under the same internal processes and policies, a contract concluded or to be concluded in the data subject's interest, a public-interest or judicial-administration ground, the recognition, exercise, or defense of a right in a judicial proceeding, or the maintenance or performance of a legal relationship between the responsable and the data subject.

The chapter treats domestic and cross-border transfers under the same regime rather than imposing a separate data-localization or adequacy-list requirement for transfers leaving Mexico.

Article 21 lets any data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection), none conditioning or blocking the others, and requires personal data to be safeguarded so these rights can be exercised without delay. Article 22 gives a right of access to the data subject's personal data and to the conditions of its processing through the privacy notice.

Article 23 gives a right to rectify or correct inaccurate, incomplete, or outdated personal data. Article 24 gives a right to cancel personal data from the responsable's files, records, and systems at any time, subject to a blocking period equal to the statute of limitations for the underlying legal relationship before the data is finally suppressed, with notice to the data subject once cancelled and to any third party the data were transferred to before the cancellation.

Article 25 lists the grounds on which the responsable need not cancel data (a contractual necessity, a legal requirement, an obstacle to judicial or administrative proceedings, the data subject's own protected interests, the public interest, a legal obligation of the data subject, or a health professional's care under a duty of secrecy).

Article 26 gives a right to object to processing for a legitimate cause, including an unqualified right at article 26, fracción II to object to a fully automated decision that produces undesired legal effects or significantly affects the data subject's interests, rights, or freedoms, and that is intended to evaluate, without human intervention, their professional performance, economic situation, health status, sexual preferences, reliability, or behaviour; objection does not lie where processing is necessary to comply with a legal obligation imposed on the responsable.

Articles 27 to 30 set the request's required content and require the responsable to designate a person or department to handle it. Article 31 requires the responsable to communicate its determination within a maximum of twenty days of receiving an ARCO request, to give effect to a favourable determination within fifteen days of that communication, and lets both periods be extended once for an equal period on justified grounds.

Article 33 lists the grounds on which an ARCO request may be denied (inadequate identification, the data not being in the responsable's possession, a third party's rights, a legal impediment or an authority's ruling, or a request already carried out), each requiring written reasons.

Article 34 makes exercising ARCO rights free, limited to reproduction, copying, or shipping costs, and caps a repeat request within twelve months at three times the Unidad de Medida y Actualización absent a substantial change to the privacy notice.

Article 38 charges the Secretaría with disseminating knowledge of the right to data protection, promoting its exercise, and overseeing compliance with the Law.

Article 39 gives the Secretaría the power to monitor and verify compliance, interpret the Law administratively, support responsables technically, issue criteria and recommendations, publish security standards and best practices, resolve rights-protection and verification proceedings and impose sanctions, cooperate with other supervisory authorities, and prepare privacy-impact studies before new processing modalities, among other functions.

Article 40 lets a data subject or representative file a rights-protection request with the Secretaría within fifteen days of the responsable's response, or after the response deadline lapses without one, when the responsable denies, ignores, or inadequately answers an ARCO request; the Secretaría gives the responsable fifteen days to answer, admits evidence, and allows five days for closing arguments.

Article 42 sets a maximum of fifty days to resolve the rights-protection request, extendable once for an equal period on justified cause. Article 43 gives the responsable ten days to give effect to a favourable resolution once notified. Article 45 lets the Secretaría cure deficiencies in the complaint without altering its original content. Article 46 lets the Secretaría dismiss the request, confirm, revoke, or modify the responsable's response, or order delivery of the data.

Article 49 lets the Secretaría seek conciliation between the parties at any point, with a binding written agreement closing the matter. Article 51 lets a party challenge a Secretaría resolution by amparo before specialized federal courts, and article 52 lets the Secretaría publish its resolutions with the data subject's identifying references removed.

Article 53 lets a data subject who suffered damage or injury from the responsable's or persona encargada's non-compliance pursue the compensation available under other applicable law.

Article 54 lets the Secretaría open a verification procedure on its own initiative or on request, and article 56 opens a sanctions procedure when a rights-protection or verification proceeding surfaces a suspected violation; article 57 gives the accused responsable fifteen days to submit evidence and five days for closing arguments, with a fifty-day resolution deadline extendable once for an equal period.

Article 58 lists nineteen infractions, from failing to satisfy an ARCO request without justified reason to processing personal data contrary to the Law's principles, creating a sensitive-data database without a justified purpose, and obstructing a verification act.

Article 59 fines an infraction from 100 to 160,000 times the Unidad de Medida y Actualización for the lesser infractions and 200 to 320,000 times the UMA for the more serious ones, adds 100 to 320,000 UMA for a repeated infraction, and lets sanctions for infractions involving sensitive personal data double.

Article 60 lists the factors the Secretaría weighs when it grounds a sanction: the nature of the data, how plainly unjustified the responsable's refusal was, intent, the responsable's economic capacity, and recidivism. Article 61 states that these administrative sanctions apply without prejudice to any resulting civil or criminal liability.

Articles 62 to 64 create criminal offences: three months to three years' imprisonment for a person authorized to process personal data who, for profit, causes a security breach of a database in their custody; six months to five years' imprisonment for anyone who processes personal data through deceit for undue profit, taking advantage of the data subject's or an authorized person's error; and double the penalty in either offence where the data processed is sensitive personal data.

Article 2, fracción VI defines sensitive personal data as data touching the data subject's most intimate sphere, or whose misuse could cause discrimination or a serious risk to them, and lists, illustratively but not exhaustively, racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, political opinions, and sexual preference; the list does not name a biometric identifier, voiceprint, or faceprint, so a biometric identifier not otherwise tied to one of the enumerated categories is protected only as ordinary personal data under this Law's general regime.

Article 8 requires the data subject's express, written consent, given by autograph signature, electronic signature, or another authentication mechanism, before processing sensitive personal data, and bars creating a database of sensitive personal data unless its creation serves a legitimate, specific purpose consistent with the responsable's explicit activities or aims.

Article 12 requires the responsable to make reasonable efforts to limit the period sensitive personal data is processed to the minimum indispensable, on top of the general proportionality principle article 12 states for personal data generally.

Article 9, fracción VI separately lets a responsable process sensitive personal data without consent for medical prevention, diagnosis, care, or health-service management while the data subject cannot consent, carried out by someone bound by professional secrecy.

Article 211 bis 1 punishes with 6 months to 2 years' imprisonment and a fine anyone who, without authorisation, modifies, destroys, or causes the loss of information contained in a computer system or equipment protected by a security mechanism, and with 3 months to 1 year's imprisonment anyone who, without authorisation, learns of or copies such protected information.

Articles 211 bis 2 and 211 bis 3 impose heavier penalties, up to 10 years for public-security systems, for the same conduct against a State computer system, distinguishing an outsider acting without authorisation from an insider authorised to access the system who acts improperly within it. Articles 211 bis 4 and 211 bis 5 apply a parallel regime to financial-sector computer systems.

Article 211 bis 7 increases every penalty in the chapter by up to one half where the information obtained is used for the offender's own benefit or a third party's. Each offence turns on defeating a security mechanism protecting the system ("protegidos por algún mecanismo de seguridad") without authorisation; the text does not on its face reach reading a page that carries no such mechanism.

Article 114 Bis lets a copyright or related-right holder implement an effective technological protection measure, defined as any technology, device, or component that, in the normal course of its operation, protects the right or controls access to a work, performance, or phonogram, and lets rights-management information be attached to a work.

Article 232 Bis fines, from 1,000 to 20,000 times the Unidad de Medida y Actualización (UMA), anyone who produces, reproduces, manufactures, distributes, imports, markets, leases, stores, transports, offers, makes available, or otherwise supplies a device, mechanism, product, component, or system that is promoted, marketed, or advertised for the purpose of circumventing an effective technological protection measure; is used predominantly for that purpose; or is designed, produced, or executed for that purpose.

Neither article names crawling, scraping, or a bot as such; the prohibition reaches circumventing an access-control or copy-control mechanism on a copyrighted work regardless of the collection method used afterward.

Article 107 protects a database or other machine-readable material as a compilation where its selection or arrangement of content constitutes an intellectual creation, and the protection does not extend to the underlying data and materials themselves. Article 108 separately protects a non-original database in its exclusive use by whoever compiled it, for 5 years, without requiring the originality Article 107 asks of a compilation.

Article 109 conditions access to, and publication, reproduction, disclosure, public communication, or transmission of, private information about identifiable people contained in such a database on the prior authorisation of the persons concerned, exempting law-enforcement investigations and lawful access to public archives.

Article 110 gives the holder of the patrimonial right over a database the exclusive right to authorise or prohibit its reproduction, translation, adaptation, reordering or other modification, distribution, and public communication, including of the results of a permitted modification. Mexico's regime protects the compilation's selection and arrangement and, separately, a 5-year producer-style exclusive-use right over a non-original database.

Article 76 Bis opens the chapter: its rules apply to the relationship between a proveedor (provider) and a consumidor (consumer) in a transaction carried out through medios electronicos, opticos o de cualquier otra tecnologia. Fraccion I requires the provider to keep the consumer's information confidential and not disclose it to another provider outside the transaction without the consumer's express authorization or a competent authority's request.

Fraccion II requires the provider to use an available technical security element to give security and confidentiality to that information, and to tell the consumer, before the transaction closes, the general characteristics of that element.

Article 76 Bis 1 separately requires a provider that offers, commercializes or sells goods, products or services using those means to follow the Norma Mexicana the Secretaria de Economia issues for electronic commerce, which the article specifies must contain at least seven categories of information; fraccion V of that list is reliable technical security mechanisms guaranteeing the protection and confidentiality of the consumer's personal information and of the transaction itself.

Neither article names a sector, a company size or a data category; the duty runs to any provider transacting electronically with a consumer in Mexico.

Procuraduria Federal del Consumidor (PROFECO), the decentralized administrative authority the LFPC itself creates to protect consumer rights, enforces the statute; this chapter creates no distinct criminal offence and no separate private right of action beyond PROFECO's ordinary consumer-complaint and sanction procedures under the LFPC's general fine bands (Arts. 126 to 128 Bis, amounts adjusted annually by DOF accord and not restated here to avoid publishing a figure that goes stale before the next adjustment).

Article 69 Bis requires the Secretaría de Gobernación to issue the guidelines classifying video games distributed, marketed, or rented by any means, and to oversee compliance. A video-game distributor must print or affix the applicable classification on the game's cover and in its advertising. A video-game marketer must not advertise, exhibit, sell, or rent a video game whose classification is not visible under the guidelines.

A video-game marketer or renter must require a person seeking to buy or rent a video game classified as exclusively for adults to prove they have reached the age of majority, without which the sale or rental may not proceed. Article 148, fracción VII Bis, makes contravening this duty an infraction, sanctioned under Article 149 with a fine of 3,000 to 30,000 days of the general minimum wage in effect when the conduct occurred, doubled on recidivism. The article itself does not specify a required proof-of-age method.

Article 148's chapeau permits using an already-divulged literary or artistic work, without the rightsholder's authorisation and without remuneration, provided the normal exploitation of the work is not affected, the source is always cited, and the work is not altered, only in the cases the article then lists. Fracción I permits quoting a text, provided the amount taken cannot be considered a simulated and substantial reproduction of the work's content.

Fracción II permits reproducing articles, photographs, illustrations, and commentary on current events, published by the press or broadcast by radio, television, or any other medium, unless the rightsholder has expressly prohibited that use. Fracción II's own permission is opt-out rather than opt-in: a news publisher who has not expressly prohibited the reuse cannot object to a reproduction that otherwise meets Article 148's conditions.