Mexico's federal private-sector data-protection law governs personal information held and processed by private persons. For payments, its subject is the individual data used by providers, placing that processing within a framework distinct from the authorisation of payment services.
TL;DR:
- The 2025 private-sector law sets personal-data principles, notices and lawful-use conditions.
- Requires security, ARCO rights and compliant disclosures and transfers.
- Different payment, fraud and marketing purposes require their own processing assessment.
Summary
The private-sector personal-data framework
The Ley Federal de Protección de Datos Personales en Posesión de los Particulares published in March 2025 establishes the private-sector framework for processing personal information in Mexico. The current parliamentary text incorporates later amendments. Its subject is the collection and use of data about people, rather than whether a company may provide a payment service. A regulated financial business can therefore have responsibilities under both its financial framework and this information-protection law.
Purposes, notices and processing conditions
The law connects processing with defined purposes, privacy information and the relevant consent or other permitted conditions. A payment provider can use information to execute a transaction, meet legal obligations, investigate risk or conduct marketing, but these uses do not automatically have identical treatment. The customer notice and the actual processing need to correspond. A broad commercial relationship should not be treated as unlimited authority to collect or disclose unrelated personal information.
Individual rights and protection of information
The framework addresses access, rectification, cancellation and opposition rights, commonly described as ARCO, subject to the law's conditions. It also establishes security responsibilities and treatment of qualifying security incidents. These duties involve the organisation's handling of information throughout the relationship, not only a notice displayed during registration. Identity checks for rights requests, response processes and appropriate safeguards need to be considered alongside the legitimate retention and other legal duties affecting the same records.
Transfers and financial-service responsibilities
Disclosures and transfers need to be assessed within the law's provisions and the purposes involved. Payment chains can contain several organisations handling customer or transaction information, making their actual responsibilities important. A processor's technical connection or a bank's financial permission does not settle the data-protection question. Applying the current private-sector law together with relevant financial duties keeps customer rights, security and information sharing connected without confusing them with authorisation of the underlying payment activity.
Keywords
- Mexico privacy
- 2025 law
- private-sector data
- privacy notices
- consent conditions
- ARCO rights
- security safeguards
- information transfers
- processing purposes
- customer disclosures