EveryAILaw.comFederal Law on the Protection of Personal Data (LFPDPPP) — 2025 AI Provisions
Obligations Covered
Timeline
| Milestone | Date | Notes |
|---|---|---|
| Original LFPDPPP enacted | Jul 5, 2010 | First comprehensive private-sector data protection law |
| Constitutional reform dissolving INAI | Dec 20, 2024 | Autonomous data protection authority abolished |
| 2025 revision published in DOF | Mar 20, 2025 | AI-specific provisions added; enforcement transferred to SABG |
| Effective date | Mar 21, 2025 | Day after publication in Federal Official Gazette |
| Secondary regulations consultation | 2026-01 | Stakeholder dialogues initiated; implementing rules pending |
| Procedural harmonisation reform | Nov 14, 2025 | DOF omnibus decree for the Código Nacional de Procedimientos Civiles y Familiares amended Art. 4 (suppletory procedural law) only; no tracked obligation affected. Staged entry into force per state declarations, automatic 2027-04-01 |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
Provisions (2)
Algorithmic Transparency and Disclosure #
The statute reaches AI only indirectly. Art. 2 Fraction XIX defines "tratamiento" to include operations carried out by automated procedures, so processing personal data with AI is covered, and the Art. 14-17 privacy-notice duties apply. The consolidated text (Última Reforma DOF 14-11-2025) contains no occurrence of "inteligencia artificial" or "algoritmo", and Art. 15 does not require disclosure of algorithmic logic, significance, or consequences. Any such duty would have to come from the pending secondary regulations.
Requirements
| Requirement | Details |
|---|---|
| Privacy notice contents | Art. 15 requires the notice to state the controller's identity and address, the data processed and which of it is sensitive, the purposes and which require consent, the means offered to limit use or disclosure, the mechanisms for exercising ARCO rights, and how changes to the notice will be communicated |
| Automated processing in scope | Art. 2 Fraction XIX brings processing carried out by automated procedures within "tratamiento", so AI-based processing of personal data is covered by the notice duties |
| Delivery of the notice | Arts. 16-17 govern how and when the privacy notice must be made available, including where data is not obtained directly from the data subject |
Penalties
| Violation | Fine |
|---|---|
| Standard violations | 100–160,000 UMA (Art. 59(II)) |
| Serious violations | 200–320,000 UMA (Art. 59(III)) |
| Sensitive personal data | Additional fine of 100–320,000 UMA |
Human Oversight in Automated Decisions #
The statute provides a right to object, not a duty of oversight. Art. 26(II) lets a data subject oppose processing where their data undergoes automated processing that produces unwanted legal effects or significantly affects their interests, rights, or freedoms, and is intended to evaluate personal aspects — professional performance, economic situation, health, sexual preferences, reliability, or behaviour — without human intervention. The text imposes no human-in-the-loop requirement, no impact assessment, and no safeguards specific to agentic systems; those appeared in secondary commentary and, if they arrive, will come from the pending implementing regulations.
Requirements
| Requirement | Details |
|---|---|
| Right to object to ADM | Art. 26(II) gives the data subject a right, at any time and for legitimate cause, to oppose or demand cessation of processing where the data is subject to automated processing producing unwanted legal effects or significantly affecting their interests, rights, or freedoms |
| Evaluation without human intervention | The right is triggered where the processing is intended to evaluate personal aspects without human intervention, in particular professional performance, economic situation, health, sexual preferences, reliability, or behaviour |
| Effect of a valid objection | Where the objection succeeds, the controller must cease the processing; the law places the remedy with the data subject rather than imposing a standing oversight duty on the controller |
Penalties
| Violation | Fine |
|---|---|
| Standard violations | 100–160,000 UMA (Art. 59(II)) |
| Serious violations | 200–320,000 UMA (Art. 59(III)) |
Cite this regulation
Permalink: https://everyailaw.com/regulation/mx-lfpdppp/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “Federal Law on the Protection of Personal Data (LFPDPPP) — 2025 AI Provisions”, EveryAILaw.com, Aug 1, 2026. https://everyailaw.com/regulation/mx-lfpdppp/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.