Mexico: the LFPDPPP reform and the future of data protection
Mexico is moving toward a deep reform of its personal data protection framework. What's expected and how to prepare now.
Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), in force since 2010, has needed modernization for years. The 2024 constitutional reform affecting INAI accelerated the discussion: 2026 will bring a new institutional architecture and renewed obligations for companies.
What to expect from the reform
- New oversight authority: after INAI's dissolution, functions are redistributed between the Anti-Corruption Secretariat and other bodies.
- Biometric and AI data: new sensitive data categories, especially those generated by AI and facial recognition systems, will receive special protection.
- Higher fines: the sanction regime would be updated with significantly higher UMA-based fines.
- Breach notification: explicit obligation to report incidents in short timeframes.
- International transfers: partial alignment with GDPR principles for transfers to countries without adequate level.
The present remains mandatory
While reform takes shape, current obligations are still in force: privacy notice, ARCO rights, controller designation, security measures.
How to prepare now
Implement personal data governance with GDPR/Law 21.719 criteria from now, because the entire region is converging toward that standard. GOBERNANZA.IO maps current LFPDPPP + expected reform into a single control set.