Laws and data licensing
Mexico: privacy laws and AI data licensing
Short answer
If your records include people in Mexico, the main rules are: Federal private-sector data protection law.
In short
- Country
- Mexico
- Main privacy laws
- Federal private-sector data protection law.
- Note
- Notice and consent framework.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Notice and consent framework.
For suppliers#
- SourceX works with businesses based in Mexico when at least 90% of their records are in English
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
What changed in Mexico's private-sector data protection law in 2025?#
Mexico replaced its 2010 private-sector law with a new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). The original text on the Chamber of Deputies site is dated March 20, 2025, enters into force the day after its publication in the Diario Oficial de la Federación (DOF), and abrogates the 2010 law. The consolidated text shows a later reform dated November 14, 2025.
Notices, contracts and internal guidance written for the 2010 law may cite superseded article numbers, so they are worth rechecking against the current consolidated text before records are reused.
What should a business check in its Mexican privacy notices before records are reused?#
The privacy notice (aviso de privacidad) people actually saw is the first document to read before any reuse, because it records who collected the data and for which purposes. A new use that the notice does not cover is the main place a reuse plan can fail, so the file should be checked before records are offered to anyone.
Consent is the second check. Counsel should confirm, against the current consolidated text, what kind of consent the data requires (for example, whether financial or sensitive fields are present) and whether the consent records survive.
| Check | Why it matters | What to look for in the file |
|---|---|---|
| Is the new use listed in the notice? | A use outside the stated purposes is the most common gap | The purpose wording in the notice version people actually saw |
| Did the notice cover who collects and how to exercise rights? | Gaps may undermine reliance on the notice | Controller identity, data list, purposes, rights-request process |
| Is the consent basis documented? | Reuse depends on proof of what people agreed to | Records of how and when consent was obtained |
| Are sensitive or financial data present? | These fields may need stronger consent or removal | Signed or authenticated consent, or removal of those fields |
| Will a third party receive the data? | Transfers are handled separately from vendor processing | The transfer wording in the notice and its recorded answer |
When does sharing Mexican records with another company need consent?#
Sharing with a processor and transferring to a third party are usually treated differently. A vendor that prepares records strictly on a company's instructions is usually a processor (the encargado), while a recipient that uses the data for its own purposes, such as training its own models, is usually a third-party recipient.
In the consolidated text, when the controller intends to transfer personal data to national or foreign third parties other than the encargado, Article 35 requires it to communicate the privacy notice and the purposes to them. Whether the person accepted the transfer, whether any listed exception applies, and whether the records can leave in dissociated (de-identified) form are questions for counsel to confirm on the actual facts.
SourceX can consider companies in Mexico when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.
- Collect every privacy notice version in force while the records were gathered
- Map each intended use to a stated purpose or plan new consent
- Flag sensitive and financial fields and their consent evidence
- Decide whether each recipient is an encargado or a third-party recipient
- Document the dissociation method if records will leave in de-identified form
Sources for this section
- The original LFPDPPP text is dated March 20, 2025, enters into force the day after its publication in the DOF and abrogates the 2010 law. Source
- The consolidated LFPDPPP shows a reform dated November 14, 2025 and, in Article 35, requires the controller to communicate the privacy notice and purposes to third parties other than the encargado. Source
Frequently asked questions
Which privacy laws apply to records about people in Mexico?
Federal private-sector data protection law. Notice and consent framework.
Can a company based in Mexico license its data through SourceX?
Yes, when at least 90% of the company's records are in English. U.S. companies are SourceX's priority, records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in Mexico?
Records tied to Mexico are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.