The New LFPDPPP: What Has Changed and What Your Company Should Review

The new Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) has been in force since March 21, 2025. For companies, the change goes beyond the statutory text: the authority to which they are accountable has also changed.

A new authority

The competent authority is now the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno). Verification and penalty proceedings will be conducted before it.

Key penalties

Fines reach up to 320,000 UMA per violation (Art. 59), may be doubled where sensitive data is involved, and repeat violations incur an additional fine. With the 2026 UMA (MXN 117.31), the ceiling is approximately MXN 37.5 million per violation.

Three changes that are often overlooked

• Financial or asset-related data: express consent from the data subject is now required, except where statutory exceptions apply (Art. 7).
• Simplified privacy notice: when data is collected electronically, such as through a website or an app, the simplified notice must be made available, indicating where the full notice may be consulted (Art. 16).
• ARCO deadlines: 20 days to respond and 15 days to implement the response, each extendable once for an equal period (Art. 31).

What to review in your company

These are general recommendations to get started; each organization should assess them in light of its operations:

• Data inventory: what data you process, for what purposes, where it is stored and who has access.
• Privacy notice: ensure it reflects actual processing practices and the current legal framework.
• Data processing agreements: suppliers that process data on the company's behalf.
• ARCO procedure: how to receive and respond to data subject requests.
• Incident response protocol: what to do, who makes decisions and how to document a breach.