Mexico's 2025 Data Protection Law: What US Companies Should Know

US companies that work with remote talent in Mexico, sell to Mexican customers or use Mexico-based providers sometimes ask how Mexican privacy law affects them. The answer changed in 2025. Mexico enacted a new Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, or LFPDPPP), published in the Official Gazette on March 20, 2025, replacing the 2010 law of the same name. The official consolidated text is published by the Chamber of Deputies (LFPDPPP, PDF).

This article gives US companies a practical overview: who the law applies to, its core principles, privacy notices, data subject rights, security and breach duties, transfers, the new oversight authority and what it means when a remote assistant in Mexico handles data. It's general information, not legal advice. Privacy obligations depend on facts, so consult qualified Mexican counsel for your situation.

Why it matters for remote staffing

Three situations bring Mexican privacy law into view:

1. Your provider or team is in Mexico and handles personal data on your behalf, including data about your US customers.
2. You process data about people in Mexico, such as Mexican customers, leads or candidates.
3. You handle personal data of the assistants themselves, such as recruitment and HR data, which Mexican law protects.

Each situation raises different questions about who is responsible and which law applies. US laws, such as HIPAA, GLBA and state privacy laws, continue to apply to US data as well.

Key roles: responsible party and processor

The law distinguishes between the responsable (the party that decides on the processing, similar to a "controller") and the persona encargada (a party that processes data on the responsible party's behalf, similar to a "processor"). When a provider in Mexico processes data for a US client under instructions, it's often acting as a processor; but the analysis depends on the arrangement. Contracts should define roles, instructions, confidentiality and security obligations.

Core principles

Article 5 of the law requires responsible parties to observe the principles of legality, purpose, loyalty, consent, data quality, proportionality, information and accountability. In plain terms: collect data lawfully, for defined purposes, with appropriate consent or legal basis, keep it accurate, use only what's necessary, tell people what you do and be able to show compliance.

Consent

Processing generally requires the consent of the data subject, with exceptions listed in the law, such as processing required by law or necessary to fulfil obligations from a legal relationship with the data subject (Articles 7–9). Consent can be express or tacit; tacit consent is generally valid once the privacy notice has been made available, but financial or property data requires express consent, and sensitive personal data, such as health data, requires express written consent through a signature or another authentication mechanism (Articles 7–8). When an assistant collects personal data in Mexico, for example during recruiting or customer outreach, make sure the consent approach has been reviewed.

Privacy notices

The law requires responsible parties to inform data subjects through a privacy notice (aviso de privacidad) about what data is collected and why (Articles 14–17). Article 15 lists the minimum contents. If your business collects data from people in Mexico, your privacy notice may need to meet these requirements, often in Spanish.

ARCO rights

Data subjects have rights of Access, Rectification, Cancellation and Opposition, known as ARCO rights (Articles 21–34). Responsible parties must respond within the time limits set by the law; Article 31 sets a maximum of twenty days to communicate the decision on a request. Assistants who handle inboxes or customer requests should know how to recognize an ARCO request and route it to the right person immediately.

Security and confidentiality

Article 18 requires administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized use or access, taking into account risk, possible consequences, data sensitivity and technological development. Article 20 requires controls to ensure confidentiality by everyone involved in processing, continuing after their relationship ends.

For remote staffing, that means the familiar controls: company-managed accounts, MFA, a password manager, least-privilege access, device policies, training and confidentiality agreements. See data security for remote assistants and managed devices vs BYOD.

Security breaches

Article 19 requires responsible parties to inform data subjects immediately of security breaches that significantly affect their property or moral rights, so they can take measures to protect themselves. Your incident response plan should cover what happens if a breach involves data subject to Mexican law. See incident response for remote assistants.

Transfers

When a responsible party transfers personal data to third parties other than its processor, it must communicate the privacy notice and purposes to the recipient, and the recipient assumes the same obligations (Article 35). Article 36 lists cases in which transfers can occur without consent. Transfers between a US client and a Mexican provider, in either direction, should be mapped and documented.

The oversight authority

Under the 2025 reform, oversight moved from the former National Institute for Transparency, Access to Information and Personal Data Protection (INAI) to the Secretaría Anticorrupción y Buen Gobierno, which the law refers to as "the Secretaría". It handles data protection procedures, verification and sanctions. Its public site is at gob.mx/buengobierno.

Sanctions

The law sets out infractions (Article 58) and sanctions (Article 59), including warnings and fines, with criminal penalties for certain serious conduct (Articles 62–64). Sanctions consider factors such as the nature of the data and the intent.

Recruiting and HR data

Providers in Mexico handle substantial personal data about candidates and assistants: identification documents, contact details, employment history, background checks and sometimes health information for benefits. This data is protected by Mexican law. When you interview candidates or receive their resumes from a provider, treat that information carefully: share it only with people involved in hiring, store it in approved locations and don't keep it longer than necessary. If you ask for references or background information, coordinate through your provider so the right notices and consents are in place.

Practical checklist for US companies

• Map what personal data flows to and from Mexico.
• Define roles (responsible party or processor) in contracts.
• Review privacy notices for people in Mexico, in Spanish where needed.
• Make sure assistants can recognize and route ARCO requests.
• Apply strong security controls and confidentiality agreements.
• Include Mexican requirements in your incident response plan.
• Get local legal advice on consent and transfers.

How ExecWing approaches privacy

ExecWing builds security and access controls into each placement and works within your policies, tools and compliance requirements. We don't claim certifications we don't hold; our security approach and roadmap are described on our security and procurement page. For broader context, see our Philippine Data Privacy Act guide, which covers similar questions for the Philippines.

A worked example

A US software company engages a bilingual customer success assistant in Monterrey to support customers in the US and Mexico. Before launch, the company's counsel reviews whether its Spanish-language privacy notice meets Mexican requirements for Mexican customers, the provider contract defines processing roles and confidentiality, and the assistant is trained to route any request to access or delete data to the privacy contact within a day. The assistant works only in company-managed accounts with MFA. When a Mexican customer asks for a copy of their data, the request reaches the privacy contact promptly and is answered within the legal time limit.

Common mistakes

Assuming only US law applies. Data about people in Mexico, and data handled in Mexico, can bring Mexican law into scope.

Relying on outdated guidance. Advice written for the 2010 law and INAI may no longer reflect the current structure.

Not training assistants on rights requests. Deadlines start when the request arrives.

Vague contracts. Define roles and security obligations.

Frequently asked questions

When did the new law take effect?

It was published in the Official Gazette on March 20, 2025. Check the consolidated text and transitional provisions for effective dates and later amendments.

Does INAI still enforce data protection?

The 2025 reform transferred oversight to the Secretaría Anticorrupción y Buen Gobierno.

Does Mexican law replace HIPAA or US state laws?

No. US obligations continue for US data. Mexican law may apply in addition, depending on the facts.

Should I get local legal advice?

Yes, for anything beyond general awareness, particularly consent, transfers and privacy notices.