Regulationsby GlyphMexico LFPDPPP 2025
In force Mexico · In force Mar 21, 2025 · no upcoming deadlines
Deadlines
New LFPDPPP in forceLaw published 20 March 2025 enters into force the following day, repealing the 2010 law.
Summaries for reference, not legal advice. Check the official text.
What it does
New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.
- Who it applies to
- Private individuals and legal entities processing personal data in Mexico (credit bureaus and purely personal/domestic processing excluded).
- Penalties
- Fines from 100 to 320,000 times the UMA depending on the infraction (100-160,000 UMA for fractions II-VII; 200-320,000 UMA for fractions VIII-XVIII), doubled for sensitive data; criminal penalties for certain misuse.
- Enforced by
- Secretaría Anticorrupción y Buen Gobierno
- Official name
- Ley Federal de Protección de Datos Personales en Posesión de los Particulares (2025)
- Citation
- DOF 20-03-2025
- Topics
- Privacy
Research notes
Implementing regulations (Reglamento) for the 2025 law were reported as still pending in 2026; the 2011 regulations apply where not contrary.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysOntario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025PIPEDACanada's federal private-sector privacy law based on 10 fair information principles, with mandatory breach reporting to the OPC and notification of individuals for breaches creating a real risk of significant harm. It is proposed to be replaced by the Protecting Privacy and Consumer Data Act (Bill C-36, tabled June 2026).In effect since Jan 1, 2001
Questions about Mexico LFPDPPP 2025
- What are the Mexico LFPDPPP 2025 compliance deadlines?
- Mar 21, 2025: New LFPDPPP in force.
- When does Mexico LFPDPPP 2025 take effect?
- Mexico LFPDPPP 2025 took effect on Mar 21, 2025.
- Who does Mexico LFPDPPP 2025 apply to?
- Private individuals and legal entities processing personal data in Mexico (credit bureaus and purely personal/domestic processing excluded).
- What are the penalties under Mexico LFPDPPP 2025?
- Fines from 100 to 320,000 times the UMA depending on the infraction (100-160,000 UMA for fractions II-VII; 200-320,000 UMA for fractions VIII-XVIII), doubled for sensitive data; criminal penalties for certain misuse.