MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
Nader, Hayaux & Goebel Paseo de los Tamarindos No. 400-B, Piso 7 Bosques de las Lomas 05120 CDMX Mexico Tel: +52 55 4170 3000 Email: info@nhg.com.mx Web: nhg.mx
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws In Mexico, personal data protection is governed by a layered framework that applies nationwide to the private sector and, through a parallel regime, to the public sector. At its apex, the Political Constitution of the United Mexican States ( Constitución Política de los Estados Unidos Mexicanos ) recognises privacy and the protection of personal data as rights. For the private sector, the main instrument is the Fed - eral Law for the Protection of Personal Data Held by Private Parties ( Ley Federal de Protección de Datos Personales en Posesión de los Particulares , or LFP- DPPP). It governs the processing of personal data by private entities across Mexico and operates as a national baseline irrespective of the state in which an organisation is established or conducts its operations. The LFPDPPP is supplemented by its Regulation ( Reglamento ), which develops and operationalises the statute and provides practical detail that the law sets out only at a high level. In addition, the private-sector regime is applied alongside secondary instruments issued by the competent authority – such as guide - lines, criteria and recommendations – which shape interpretation and enforcement practice (together with the LFPDPPP and its Regulation, the “Private DPRs”). Processing by the public sector is governed by a separate statutory regime, the General Law for the Protection of Personal Data Held by Obligated Parties
( Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados ), complemented by state-level legislation (together, the “Public DPRs”). Mexican private-sector rules do not expressly claim extraterritorial reach. Cross-border scenarios are addressed instead through transfer and accountability mechanisms. Where a data controller transfers per - sonal data to a third-party recipient that will act as an independent controller, the transferring controller must ensure that the recipient assumes and complies with obligations it is subject to under the Private DPRs. Finally, the DPRs regulate personal data only (ie, information relating to an identifiable individual). Non- personal data will generally fall outside their scope, although the boundary is not clear-cut; certain pro - cessing may still be treated as personal data. Against that backdrop, as organisations adopt automated tools and AI-enabled processing, the Private DPRs remain the central reference point for lawful process - ing and accountability, while other legal regimes may impose parallel obligations. 1.2 Rights and Obligations Principles and Requirements for Processing The Private DPRs are built around a set of principles that must be observed cumulatively, as listed below. In practice, processing will be considered compliant only where these principles are embedded in the design and day-to-day operation of processing activities.
311 CHAMBERS.COM
Powered by FlippingBook