EveryAILaw.comDoes Federal Law on the Protection of Personal Data (LFPDPPP) require Transparency & Disclosure?
Mexico • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 3 specific requirements for Transparency & Disclosure across 1 provision:
- Privacy notice contents — Art. 15 requires the notice to state the controller's identity and address, the data processed and which of it is sensitive, the purposes and which require consent, the means offered to limit use or disclosure, the mechanisms for exercising ARCO rights, and how changes to the notice will be communicated
- Automated processing in scope — Art. 2 Fraction XIX brings processing carried out by automated procedures within "tratamiento", so AI-based processing of personal data is covered by the notice duties
- Delivery of the notice — Arts. 16-17 govern how and when the privacy notice must be made available, including where data is not obtained directly from the data subject
Algorithmic Transparency and Disclosure
The statute reaches AI only indirectly. Art. 2 Fraction XIX defines "tratamiento" to include operations carried out by automated procedures, so processing personal data with AI is covered, and the Art. 14-17 privacy-notice duties apply. The consolidated text (Última Reforma DOF 14-11-2025) contains no occurrence of "inteligencia artificial" or "algoritmo", and Art. 15 does not require disclosure of algorithmic logic, significance, or consequences. No secondary regulation is bound here to establish any additional duty; such a duty remains unconfirmed.
Requirements
| Requirement | Details |
|---|---|
| Privacy notice contents | Art. 15 requires the notice to state the controller's identity and address, the data processed and which of it is sensitive, the purposes and which require consent, the means offered to limit use or disclosure, the mechanisms for exercising ARCO rights, and how changes to the notice will be communicated |
| Automated processing in scope | Art. 2 Fraction XIX brings processing carried out by automated procedures within "tratamiento", so AI-based processing of personal data is covered by the notice duties |
| Delivery of the notice | Arts. 16-17 govern how and when the privacy notice must be made available, including where data is not obtained directly from the data subject |
Penalties
| Violation | Fine |
|---|---|
| Standard violations | 100–160,000 UMA (Art. 59(II)) |
| Serious violations | 200–320,000 UMA (Art. 59(III)) |
| Repeated infractions | Additional fine of 100–320,000 UMA (Art. 59(IV)) |
| Sensitive personal data | Administrative sanctions may increase up to twice the established amounts (Art. 59(IV)) |