Does your company meet Mexico’s data protection law?

Does your privacy notice state who the responsible party is and its address?

Article 15, section I — The identity and address of the responsible party.

Does it list the personal data you process and say which of it is sensitive?

Article 15, section II — The personal data that will be processed, identifying which of it is sensitive.

Does it separate the purposes that need consent from those that do not?

Article 15, section III — The purposes of the processing, identifying those that require the consent of the individual.

Does it offer a way to limit the use or disclosure of the data?

Article 15, section IV — The options and means the responsible party offers individuals to limit the use or disclosure of the data.

Does it say how to exercise an ARCO right?

Article 15, section V — The mechanisms, means and procedures to exercise ARCO rights.

Does it explain how you will announce changes to the notice itself?

Article 15, section VI — The procedure and means by which the responsible party will inform individuals of changes to the privacy notice.

Is your notice written under the 2025 law and not the 2010 law?

Second transitory article, section I — The law in force was published in Mexico’s Official Gazette (DOF) on March 20, 2025, and repealed the 2010 law.

Does it name the correct authority, and not the INAI?

Article 2, section XV — The INAI no longer exists. The law defines “Secretaría” as the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance).

Do you have a single inbox for ARCO requests, with someone watching it?

Article 15, section V, and Article 31 — The notice must state how to exercise ARCO rights, and the Article 31 deadline runs from the day a request is received.

Do you log each request with the date received, the right being exercised and the date of the answer?

Article 31 — The deadline counts from the date of receipt, so that date is what lets you meet it and prove that you did.

Does your team know the deadline is twenty business days, not calendar days?

Article 31 and Article 2, section VIII — Twenty days to communicate the decision and fifteen more to carry it out, and each period can be extended once. The law defines “Días” (days) as business days.

Is there a written procedure that says who finds the data, who decides and who answers?

Article 31 — The law requires you to answer requests on time. A procedure is what makes that happen when the usual person is on vacation.

Do you handle requests without charging for the process?

Article 34 — “Exercising ARCO rights is free of charge; fees may only be charged to recover the costs of reproduction, copies or shipping.”

Do you have a rule for canceling data without fully deleting it, when you must keep it?

Article 24 — Under the law, canceling data leads to a blocking period before the data is deleted. That fits marking the record instead of erasing it.

If you process sensitive data, do you get express consent in writing?

Article 8 — “In the case of sensitive personal data, the responsible party must obtain the express written consent of the individual for its processing.”

Have you decided in advance who determines whether a breach significantly affects people?

Article 19 — Breaches that “significantly affect the property or moral rights” of individuals must be reported to them “immediately”.

Do you know who would write the notice to the people affected?

Article 19 — The notice has to reach people in time for them to defend their rights.