MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
– pre-closing, during diligence/transition and during post-closing integration – and align technical and organisational measures accord - ingly. • Validate compliance foundations. (a) Confirm that the data was collected and is being used under appropriate transparency practices (privacy notices) and, where required, valid consents. (b) Review whether existing security measures are proportionate to the risks and adequate for the intended deal-related processing and subse - quent integration. This approach helps reduce unnecessary exposure during due diligence, supports smoother post-closing integration, and mitigates regulatory and litigation risk when personal data forms part of the transaction foot - print. The Private DPRs permit cross-border transfers of personal data, provided the transferring data controller complies with the applicable transparency and, where required, consent requirements. For these purposes, a transfer should be understood broadly as any com - munication, disclosure or making available of personal data to a third party other than the data subject (or its subsidiaries, affiliates and service providers), within or outside Mexico. Importantly, the fact that a transfer is international does not dilute the controller’s obliga - tions: the general processing requirements continue to apply, and cross-border transfers are treated as an extension of the originating processing activity rather than as a separate, unregulated step. A defining feature of the Mexican approach is that the foreign recipient must assume obligations equivalent to those borne by the transferring controller under the Private DPRs. In practice, this is typically implemented through contractual arrangements. While the DPRs allow controllers to rely on a range of legal instru - ments to meet their duties, contractual clauses are the principal mechanism expressly contemplated for 5. International Considerations 5.1 Restrictions on International Data Transfers
international transfers. As a baseline, transfer clauses should ensure that: • the recipient undertakes to comply with obligations equivalent to those applicable to the transferring controller under the Private DPRs; and • the recipient agrees to process the data consist - ently with the scope of the authorisations and limi - tations communicated to the data subject through the applicable privacy notice (including the stated purposes and any transfer conditions). Where there is uncertainty about whether a contem - plated cross-border transfer aligns with the Private DPRs, a controller may seek a non-binding view from the competent authority on the transfer’s permissibility and the adequacy of the proposed safeguards. 5.2 Government Notifications and Approvals No government notifications or approvals are required to transfer data internationally. The data controller must include transfers of personal data in the privacy notice to inform the data subject when consent is required. 5.3 Data Localisation Requirements Mexico’s regulation on personal data protection (both Private and Public DPRs) does not establish specif - ic data localisation requirements, nor do they con - template the need to store personal data in-country. Therefore, under the scope of personal data protec - tion, data can be transferred internationally; however, data controllers are still required to implement meas - ures to safeguard data and comply with the require - ments for transferring personal data established in the DPRs, such as providing a privacy notice to the data recipient. 5.4 Blocking Statutes Aside from the nation’s sovereignty and the provi - sions of the Constitution, there are no specific statutes regarding “blocking”. 5.5 Recent Developments As discussed in 1.7 Regulators , recent regulatory changes primarily focused on dissolving the INAI and reallocating its responsibilities. On this note, the Regulation of the LFPDPPP has not been amended
318 CHAMBERS.COM
Powered by FlippingBook