Your database is valuable. Including to those who want to steal it.
Consult a partnerYour database is valuable. Including to those who want to steal it.
We bring your company's personal data processing into compliance with the new LFPDPPP and defend it before the authority. Assessment, documentation, training and ongoing monitoring.
Database theft and sale
In 2025, a 700 GB database containing Mexican individuals' banking, tax and health information was offered on a data leak forum.
Fraud using your customers' identities
Amounts claimed before CONDUSEF in connection with identity theft increased 24.6% year over year in the first half of 2025.
Unauthorized third-party use
Suppliers, agencies, cloud providers and former staff who use or retain data beyond the agreed terms.
Artificial intelligence without guardrails
63% of organizations that experienced a data breach had no AI governance policies (IBM, 2025).
The cost of overlooking the risk
241 days
average time to identify and contain a data breach
IBM, 2025
USD 4.4 M
global average cost of a data breach
IBM, 2025
320,000 UMA
maximum fine per violation of the new LFPDPPP, approximately MXN 37.5 million, which may be doubled for sensitive data
Current legal framework: new LFPDPPP in force since March 21, 2025; authority: Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno). 2026 UMA: MXN 117.31.
What We Do
- 01
Compliance assessment and gap analysis
Where your company stands under the law and what needs to be addressed, prioritized by risk.
- 02
Data inventory and mapping
What data you process, where it is stored, who accesses it and with whom it is shared.
- 03
Privacy notices and consent
Comprehensive and simplified privacy notices, and consent mechanisms.
- 04
Security document
Documented administrative, technical and physical safeguards.
- 05
ARCO rights
A procedure for handling requests for access, rectification, cancellation and objection.
- 06
Data processors and transfers
Agreements and controls governing service providers and third parties.
- 07
Data breach response
An incident response protocol and support when an incident occurs.
- 08
Defense before the authority
Handling compliance inspections, official requests and penalty proceedings.
- 09
Privacy in technology
AI, automated decision-making, biometrics, open finance and digital advertising.
- 10
Training
Department-specific programs with assessments and certificates of completion.
- 11
Programs for corporate groups
A coordinated compliance model across multiple companies.
Five stages, each with a defined deliverable.
- 01
Assessment
Deliverable
Assessment report and risk matrix
- 02
Design
Deliverable
Editable internal compliance documentation supported by applicable law
- 03
Implementation
Deliverable
Operational procedures and supporting evidence
- 04
Training
Deliverable
Materials, assessments and certificates of completion
- 05
Ongoing monitoring
Deliverable
Compliance reports and alerts
Litigation in This Practice Area
If the authority initiates a compliance inspection or penalty proceeding, we defend your company with the same team that knows your compliance program.
What changed under the new LFPDPPP?
It entered into force on March 21, 2025, and the competent authority is now the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno). Privacy notices, agreements and procedures should be reviewed.
Is my existing privacy notice still suitable?
It may need to be updated. We review it against the new legal framework.
How much can a fine be?
Up to 320,000 UMA per violation, which may be doubled for sensitive data (Art. 59). The actual amount depends on the circumstances of each case.
What should I do if I have experienced a data breach?
Activate your incident response protocol and contact us immediately to assess the necessary measures and notifications.
Supporting Partner
Israel Ledesma Meléndez
Do you have a matter in this practice area?
Tell us what you need help with. A partner will review your message.