← Data protection and cybercrime laws by country, compared
Mexico: data protection law, cybercrimes, fines and penalties
New LFPDPPP in force since 21 Mar 2025. The INAI was abolished and private-sector oversight moved to the Secretaría Anticorrupción y Buen Gobierno; enforcement remains uncertain.
- Law
- LFPDPPP (Official Gazette, 20 Mar 2025)
- Authority
- Secretaría Anticorrupción y Buen Gobierno (INAI's successor)
- Max fine
- Set in UMA units (cap not verified)
- Breach notification
- —
- DPO
- —
Crimes
| Unlawful access to computer systems | Arts. 211 bis 1–7 Federal Penal Code (CPF) | — |
| Fraud | Art. 386 CPF | — |
| Extortion | Art. 390 CPF | — |
Risks
- New, less independent authority after the INAI's abolition
- Uncertainty over enforcement
- New infraction for negligent handling of ARCO rights
- Decisions are now challenged via amparo
- The Secretaría no longer reports annually to Congress or issues studies and criteria
Source: Garrigues · IDC Online · Por Esto · Cámara de Diputados – CPF