Mexico LFPDPPP 2025: Privacy Notices, Consent, ARCO Rights

Continuity with sharper edges. The 2025 law keeps the principles (licitud, consentimiento, informacion, calidad, finalidad, lealtad, proporcionalidad, responsabilidad), the aviso de privacidad, the consent tiers, and ARCO rights. It updates definitions (broader processing and controller concepts, clearer processor duties), tightens the aviso's content requirements, and re-homes enforcement in the federal executive after INAI's dissolution. Compliance documentation built for the 2010 law needs review, not reconstruction; the aviso and consent records are where the wording changes bite.

The December 2024 constitutional reform extinguished INAI along with other autonomous bodies. Data protection oversight for the private sector moved to the Secretaria Anticorrupcion y Buen Gobierno, exercising the powers the law previously gave INAI: investigations, verification procedures, ARCO enforcement, and sanctions. Practitioners are watching how aggressively the new arrangement enforces; the prudent read is that the substantive obligations are unchanged and the procedural muscle is being rebuilt, a poor moment to be the test case.

The privacy notice is the LFPDPPP's central instrument, in full and simplified forms: the controller's identity and domicile, the personal data processed and whether sensitive data is included, the purposes (distinguishing necessary from secondary ones the person can refuse), transfer recipients and purposes, the mechanics for exercising ARCO rights and revoking consent, and how changes will be communicated. Secondary purposes need an opt-out at first contact. A missing or defective aviso is the most commonly sanctioned violation, and it is externally checkable on any website.

Three levels. Tacit consent: for ordinary data, processing may proceed once the aviso is made available and the person does not object, this covers most commercial flows. Express consent: for financial or patrimonial data (spoken, written, or by unmistakable electronic means). Express and written consent: for sensitive data (health, biometrics, ideology, religion, sexual life, ethnic origin), via signature, electronic signature, or equivalent authentication. Exceptions exist for legal obligations, emergencies, and contract necessity, but marketing always allows opposition.

The controller must answer an ARCO request within 20 business days and, if granted, implement within 15 more; the law allows one extension for justified cause. Requests go through the contact point named in the aviso (a designated person or data protection department is mandatory). Unanswered or refused requests escalate to a data protection rights procedure before the authority, and from there to sanctions, fines up to 320,000 UMA, doubled for sensitive data, and, for repeat or serious conduct, suspension of processing. Blown ARCO clocks are the classic trigger for regulatory attention.