EveryAILaw.comDoes Federal Law on the Protection of Personal Data (LFPDPPP) — 2025 AI Provisions require Transparency & Disclosure?
Mexico • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 3 specific requirements for Transparency & Disclosure across 1 provision:
- Privacy notice contents — Art. 15 requires the notice to state the controller's identity and address, the data processed and which of it is sensitive, the purposes and which require consent, the means offered to limit use or disclosure, the mechanisms for exercising ARCO rights, and how changes to the notice will be communicated
- Automated processing in scope — Art. 2 Fraction XIX brings processing carried out by automated procedures within "tratamiento", so AI-based processing of personal data is covered by the notice duties
- Delivery of the notice — Arts. 16-17 govern how and when the privacy notice must be made available, including where data is not obtained directly from the data subject
Algorithmic Transparency and Disclosure #
The statute reaches AI only indirectly. Art. 2 Fraction XIX defines "tratamiento" to include operations carried out by automated procedures, so processing personal data with AI is covered, and the Art. 14-17 privacy-notice duties apply. The consolidated text (Última Reforma DOF 14-11-2025) contains no occurrence of "inteligencia artificial" or "algoritmo", and Art. 15 does not require disclosure of algorithmic logic, significance, or consequences. Any such duty would have to come from the pending secondary regulations.
Requirements
| Requirement | Details |
|---|---|
| Privacy notice contents | Art. 15 requires the notice to state the controller's identity and address, the data processed and which of it is sensitive, the purposes and which require consent, the means offered to limit use or disclosure, the mechanisms for exercising ARCO rights, and how changes to the notice will be communicated |
| Automated processing in scope | Art. 2 Fraction XIX brings processing carried out by automated procedures within "tratamiento", so AI-based processing of personal data is covered by the notice duties |
| Delivery of the notice | Arts. 16-17 govern how and when the privacy notice must be made available, including where data is not obtained directly from the data subject |
Penalties
| Violation | Fine |
|---|---|
| Standard violations | 100–160,000 UMA (Art. 59(II)) |
| Serious violations | 200–320,000 UMA (Art. 59(III)) |
| Sensitive personal data | Additional fine of 100–320,000 UMA |