Mexico Cross-Border Data Transfers for US Companies

No. The LFPDPPP does not gate transfers on destination-country adequacy and has no standard-clause annex. Instead it makes the transferor accountable: disclose the transfer and its purposes in the aviso de privacidad, obtain consent unless an exception applies, and contractually bind the recipient to process only per the aviso. That design survives in the 2025 law. It is lighter paperwork than Brazilian SCCs but heavier notice discipline, the aviso must actually name the categories of recipients and purposes, and a transfer outside what the aviso describes is unlawful regardless of contracts.

A transferencia is a communication of data to a distinct controller (a US parent using Mexican customer data for its own purposes, a business partner, a buyer in M&A). A remision is handing data to an encargado (processor) that processes strictly on the controller's behalf, a US cloud provider, a payroll processor. Remisiones are not transfers: they need no consent and no aviso disclosure as transfers, but they do require a contract fixing the processor's obligations (process only on instructions, security, confidentiality, deletion). Misclassifying a parent-company analytics use as a remision is the classic error; if the recipient decides purposes, it is a transfer.

The statutory exceptions: transfers required by law or treaty; intra-group transfers to parents, subsidiaries, or affiliates operating under the same internal data protection policies; transfers necessary for a contract concluded or to be concluded in the data subject's interest; transfers necessary for medical care; transfers to competent authorities; and transfers necessary for the maintenance or fulfillment of the legal relationship with the data subject. The intra-group exception is the workhorse for US multinationals, but it requires genuinely common policies, adopt and document a group privacy policy covering the Mexican entity before relying on it.

The recipient must assume the same obligations that apply to the transferor under the aviso: process only for the communicated purposes, honor the LFPDPPP principles, maintain security measures, and support ARCO requests reaching back through the chain. In practice this is a transfer agreement or intercompany data-sharing agreement attaching the aviso (or its relevant terms). For processor remisiones, a DPA with instruction-only processing, security, sub-processor controls, and deletion terms. Neither requires filing with the authority, but both must exist when an investigation asks.

Independently. A Monterrey-to-Texas flow needs LFPDPPP mechanics (aviso disclosure plus consent or exception); if the same pipeline carries EU data it also needs EU SCCs, and a Brazil leg needs Brazilian SCCs under Resolution 19/2024, three regimes, three artifacts, one dataset. USMCA Article 19.11 commits the three countries not to restrict cross-border business data flows beyond legitimate public-policy measures, which keeps Mexico from adopting localization but does not exempt anyone from the LFPDPPP's consent and notice rules. Multinationals should run a per-leg transfer register rather than assuming one mechanism covers the continent.