The framework
The operative statute in Mexico is the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP 2025), enforced by the Secretariat of Anti-Corruption and Good Governance.
The posture is hybrid. Notice and purpose limitation govern collection and consent is reserved for sensitive cases, which makes first-party marketing more workable here than in strict opt-in markets.
Key instruments
LFPDPPP 2025
Replaces the 2010 federal law. Preserves ARCO rights (access, rectification, cancellation, opposition), privacy notice duties, tacit consent for non-sensitive data, and security obligations; updates definitions and shifts enforcement to the SABG with amparo review before specialized courts.
Marketing and advertising
Tacit consent works for non-sensitive data, so a business can provide the privacy notice and proceed unless the person objects. Express consent for financial data, express and written for sensitive data. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Notice-based for many transfers with consent triggers for others; group transfers and processor transfers eased.
Enforcement and penalties
Fines from 100 to 320,000 UMA (into the millions of dollars), doubled for sensitive data, plus criminal exposure; in July 2026 the SABG fined the Mexican Football Federation MXN 42.8M over biometric data in its FAN ID program.