Mexico's Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares governs the processing of personal data by private sector organisations. It applies to any organisation processing personal data of Mexican residents.
What is LFPDPPP?
The Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (LFPDPPP) is Mexico's federal data protection law for the private sector. A new LFPDPPP was published on 20 March 2025 and took effect the following day, repealing the 2010 law. The same decree dissolved INAI, the independent regulator, and moved enforcement to the Secretaria Anticorrupcion y Buen Gobierno, which now investigates breaches, audits, and imposes sanctions.
The law establishes requirements for the collection, use, storage, and transfer of personal data, with particular emphasis on the Aviso de Privacidad (privacy notice) and ARCO rights (Access, Rectification, Cancellation, and Opposition). It applies to private sector organisations processing personal data of Mexican residents.
Non-compliance can result in significant fines and reputational damage. Organisations operating in Mexico or processing data of Mexican residents must ensure their privacy practices meet LFPDPPP requirements.
Compliance requirements
LFPDPPP establishes comprehensive requirements for the processing of personal data of Mexican residents, with particular emphasis on transparency and individual rights.
Obtain valid consent or identify another legal basis for processing personal data of Mexican residents, with clear documentation of the basis for each processing activity.
Provide a comprehensive privacy notice to data subjects before or at the time of data collection, in Spanish, meeting all LFPDPPP content requirements.
Implement processes to handle Access, Rectification, Cancellation, and Opposition (ARCO) rights requests from Mexican data subjects within 20 business days.
Implement administrative, physical, and technical security measures appropriate to the sensitivity of the personal data processed.
Obtain consent for transfers of personal data to third parties, and implement appropriate safeguards for international transfers outside Mexico.
Apply heightened protections to sensitive personal data (datos personales sensibles) including health, biometric, financial, and ideological information.
Audit process
Netru manages the complete LFPDPPP compliance journey, from mapping your personal data flows through to ongoing monitoring and regulator liaison support.
We map all personal data flows involving Mexican residents, identifying processing activities, data categories, and legal bases.
We assess your current privacy practices against LFPDPPP requirements, producing a prioritised remediation roadmap.
We draft compliant Avisos de Privacidad in Spanish for all data collection points, meeting all LFPDPPP content requirements.
We implement workflows for handling ARCO rights requests within the required 20 business day timeframe.
We implement required administrative, physical, and technical security measures and document them to the standard the Secretaria expects on review.
We provide ongoing monitoring, annual reviews, and support for ARCO requests and regulatory enquiries.
How Netru delivers it
Our team combines deep knowledge of LFPDPPP requirements with practical compliance delivery. We draft compliant Avisos de Privacidad, implement ARCO rights workflows, and provide ongoing support, helping you demonstrate compliance to Mexican regulators and customers.
Talk to our teamBefore you talk to anyone