EveryAILaw.comDoes Federal Law on the Protection of Personal Data (LFPDPPP) — 2025 AI Provisions require Human Oversight?
Mexico • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 3 specific requirements for Human Oversight across 1 provision:
- Right to object to ADM — Art. 26(II) gives the data subject a right, at any time and for legitimate cause, to oppose or demand cessation of processing where the data is subject to automated processing producing unwanted legal effects or significantly affecting their interests, rights, or freedoms
- Evaluation without human intervention — The right is triggered where the processing is intended to evaluate personal aspects without human intervention, in particular professional performance, economic situation, health, sexual preferences, reliability, or behaviour
- Effect of a valid objection — Where the objection succeeds, the controller must cease the processing; the law places the remedy with the data subject rather than imposing a standing oversight duty on the controller
Human Oversight in Automated Decisions #
The statute provides a right to object, not a duty of oversight. Art. 26(II) lets a data subject oppose processing where their data undergoes automated processing that produces unwanted legal effects or significantly affects their interests, rights, or freedoms, and is intended to evaluate personal aspects — professional performance, economic situation, health, sexual preferences, reliability, or behaviour — without human intervention. The text imposes no human-in-the-loop requirement, no impact assessment, and no safeguards specific to agentic systems; those appeared in secondary commentary and, if they arrive, will come from the pending implementing regulations.
Requirements
| Requirement | Details |
|---|---|
| Right to object to ADM | Art. 26(II) gives the data subject a right, at any time and for legitimate cause, to oppose or demand cessation of processing where the data is subject to automated processing producing unwanted legal effects or significantly affecting their interests, rights, or freedoms |
| Evaluation without human intervention | The right is triggered where the processing is intended to evaluate personal aspects without human intervention, in particular professional performance, economic situation, health, sexual preferences, reliability, or behaviour |
| Effect of a valid objection | Where the objection succeeds, the controller must cease the processing; the law places the remedy with the data subject rather than imposing a standing oversight duty on the controller |
Penalties
| Violation | Fine |
|---|---|
| Standard violations | 100–160,000 UMA (Art. 59(II)) |
| Serious violations | 200–320,000 UMA (Art. 59(III)) |