Federal Law on the Protection of Personal Data Held by Private Parties

Introduction

The Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) is Mexico’s primary data protection legislation. Enacted in 2010, the law governs the processing of personal data by private entities, establishes the rights of data subjects, and creates enforcement mechanisms through the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

Scope and Application

The LFPDPPP applies to all private individuals and legal entities that process personal data in Mexico, unless exceptions apply (such as national security, criminal investigations, or journalistic purposes). The law applies to personal data processing carried out in Mexico, as well as processing abroad where the data controller is established in Mexico or uses means located in Mexico.

Principles of Data Processing

The LFPDPPP establishes several principles governing data processing: legitimacy (consent or other lawful basis); purpose (data must be processed for specified, explicit, and legitimate purposes); proportionality (only data necessary for the purpose may be processed); quality (data must be accurate, complete, and up to date); and security (data must be protected through appropriate technical and organizational measures).

ARCO Rights

The LFPDPPP grants individuals four principal rights (ARCO rights): access (acceso) — the right to know what personal data is held; rectification (rectificación) — the right to correct inaccurate data; cancellation (cancelación) — the right to have data deleted when no longer necessary; and opposition (oposición) — the right to object to data processing for legitimate reasons.

Consent

The LFPDPPP requires the consent of the data subject for the processing of personal data. Consent may be express or tacit, depending on the type of data. Sensitive personal data (such as health, religion, sexual orientation, and biometric data) requires express written consent. The data controller must inform the data subject of the purposes of processing before obtaining consent.

Enforcement and Sanctions

The INAI enforces the LFPDPPP through: investigations; orders to cease violations; administrative sanctions (fines up to 320,000 days of minimum wage); and criminal prosecution for certain violations. The INAI also issues guidelines, recommends best practices, and promotes data protection awareness. Data subjects may file complaints (denuncias) with INAI.

Conclusion

The LFPDPPP provides a comprehensive data protection framework aligned with international standards, including the OECD Privacy Guidelines and EU data protection principles. The law establishes robust rights for data subjects, clear obligations for data controllers, and effective enforcement through INAI.