🇲🇽Federal Law on Protection of Personal Data Held by Private Parties
Federal Law on Protection of Personal Data Held by Private Parties
The current LFPDPPP was published on 20 March 2025 and replaced the 2010 statute. The consolidated Chamber of Deputies text incorporates the reform published on 14 November 2025. The 2011 regulation continues to supply operational detail.
Core duties
Processing: Articles 5–13 require legality, purpose limitation, fairness, consent, quality, proportionality, information and accountability. Sensitive-data processing normally needs express written consent and minimum necessary duration.
Transparency and rights: Articles 14–17 govern privacy notices. Articles 21–34 establish access, rectification, cancellation and objection (ARCO), including a 20-day decision period and, where granted, implementation within the next 15 days.
Security and transfers: Articles 18–20 require administrative, technical and physical safeguards, immediate notice of materially harmful breaches, and confidentiality. Articles 35–36 govern transfers. The regulation adds processor-contract, security-document, audit, retention and cloud-service requirements.
The local PDFs are clearly labelled official-source snapshots because the publisher server did not complete a direct binary transfer. Their text was extracted from the current official Chamber PDFs; the official URLs are recorded inside each snapshot and in the source register.