TLDR: Mexico replaced its decade-old privacy law in March 2025, folding oversight into a government ministry after shutting down the independent watchdog that used to handle it. Businesses now have broader obligations, including direct responsibility for vendors who process data on their behalf, and the rules for what counts as valid consent have shifted in ways that are easy to miss.
A Law Built for a Different Era Gets Replaced
For fifteen years, Mexico’s privacy framework ran on the Federal Law on the Protection of Personal Data Held by Private Parties, passed back in 2010. A lot has changed since then. Cloud storage wasn’t standard practice yet, and nobody was writing rules for AI vendors.
The government published a new version of that law on March 20, 2025, and it took effect the next day. It carries the same name, but the mechanics underneath it are different enough that companies operating in Mexico can’t just assume their old compliance checklist still works.
The Short Version
The new law keeps the core idea that people own their personal data and have to consent to how it’s used. What changed is who enforces that, how broad the obligations are, and who’s on the hook when something goes wrong.
The Watchdog Is Gone
Here’s the part that caught a lot of legal teams off guard. The old law was enforced by INAI, an independent body that handled both transparency requests and data protection complaints. As part of this reform, INAI was dissolved.
Enforcement now sits with a ministry inside the executive branch instead of a standalone agency. Supporters say this streamlines a bloated bureaucracy. Critics argue that folding data protection oversight into the government removes a layer of independence that used to exist between regulators and the officials they might need to investigate. Either way, if your company had an open complaint or proceeding when the switch happened, it doesn’t just vanish. Cases that started under the old law are still governed by it, just handled by the new ministry instead of INAI.
Consent Rules Got More Specific
Under the new law, consent has to be free, specific, and informed. That phrasing sounds close to what GDPR requires in Europe, and that’s not an accident. Mexico is nudging its standards closer to international norms while keeping some local quirks.
One of those quirks: tacit consent is still good enough in most cases. You don’t need someone to click an explicit “I agree” button for routine processing. But the law carves out situations where prior, explicit consent is required, and getting that distinction wrong is one of the easier ways to end up out of compliance.
What Your Privacy Notice Needs Now
Privacy notices have to spell out, clearly, which purposes require consent and which don’t. A vague, catch-all notice that lumps everything together isn’t going to hold up the way it might have under the 2010 law. If you haven’t looked at your Spanish-language privacy notice in a while, now’s the time.
Vendors Are Now Directly Liable
This is probably the change that matters most for companies working with outside contractors, cloud providers, or marketing platforms. The new law expanded its scope to clearly cover data processors, not just the businesses that collect the data in the first place.
In practice, that means your vendors can carry direct legal responsibility if they mishandle personal data, instead of the liability flowing only back to you as the data controller. It’s worth revisiting your vendor contracts to make sure responsibilities are spelled out the way the law now expects.
Businesses Are Operating With Some Uncertainty
The executive branch had 90 days after the law took effect to issue detailed implementing regulations. Those regulations fill in a lot of the practical detail that the law itself leaves open, things like specific documentation requirements and how audits will actually run.
That gap matters. Companies preparing for compliance have had to work from the law’s general language while waiting on the fine print, which isn’t an ideal position for anyone trying to build a defensible compliance program.
A Reasonable Starting Point
Legal advisors working on this have mostly landed on the same advice. Audit your current privacy notices and policies against the new law’s language. Check your vendor agreements for data processing clauses. And don’t wait for every regulation to be finalized before you start, because the core obligations are already in force.
Mexico’s privacy reform didn’t rewrite the rulebook from scratch, but it moved enough pieces that businesses relying on their old compliance setup are likely exposed somewhere. The companies handling this well are treating it less like a one-time checklist and more like an ongoing review, especially while the regulatory details continue to take shape.
