Mexico: Federal Law on protection of personal data held by private parties, including data protection regulation, was introduced to Mexican Senate (No. LXVI/1SPO-1645)

On 25 February 2025, the Federal Law on the protection of personal data held by private parties, including data protection regulation, was introduced to the Mexican Senate. The law applies to all private entities and individuals processing personal data, regardless of the form or medium used, and introduces definitional and procedural changes. It broadens the scope of data processing, redefines the role of the data controller under the term regulated subjects, and excludes public access sources if the information was obtained unlawfully. The law introduces stricter requirements for obtaining consent when processing data for new purposes, allows individuals to object to certain forms of automated processing, and permits a charge for exercising access, rectification, cancellation, or opposition rights unless the individual provides a means of reproducing the data. Processing of sensitive data, including health information or political beliefs, requires explicit consent. The law also provides that non-compliance may lead to fines and criminal penalties including imprisonment for fraudulent data use, with harsher sentences when sensitive data is involved.