Isabel Davara F. de Marcos of Davara Abogados S.C. reports that on March 20, 2025, the Mexican Congress approved a new Federal Law on the Protection of Personal Data Held by Private Parties (“LFPDPPP”), replacing the previous 2010 federal data protection law. The LFPDPPP, which became effective March 21, 2025, represents a substantial change in Mexico’s data protection framework, impacting the scope of application, legal bases for data processing, and individual rights. Relevant updates and considerations for companies operating in Mexico include:

• expanded definition of personal data;
• broader legal bases for processing;
• stricter privacy notice requirements;
• enhanced individual rights over automated processing; and
• increased fines and a new judicial structure (i.e., the creation of specialized data protection courts to handle legal proceedings, including constitutional rights lawsuits).

The LFPDPPP dissolves the National Institute for Transparency, Access to Information and Personal Data Protection, transferring its authority to a newly created Secretariat of Anti-Corruption and Good Governance. This body will oversee compliance, conduct investigations, and impose sanctions.

Promulgating regulations are expected to be issued within 90 days from the law’s effective date, which are expected to clarify the scope and operational details of the law.