The current framework: the LFPDPPP and AI
Mexico regulates the use of AI that processes personal data primarily through the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation on 20 March 2025 and in force since 21 March 2025, which repealed the 2010 law of the same name. Although it contains no AI-specific rules, this law applies fully to artificial intelligence systems that process the data of identified or identifiable natural persons.
Since 21 March 2025 the supervisory authority has been the Secretariat for Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), which replaced the now-defunct INAI (National Institute for Transparency, Access to Information and Personal Data Protection). The INAI had issued interpretative criteria and guidance clarifying how the LFPDPPP applied in AI contexts, especially with regard to automated decisions, profiling and the transfer of data to cloud-based AI systems.
Automated decisions: what the LFPDPPP requires
The LFPDPPP requires the privacy notice to disclose the automated use of personal data to take decisions that significantly affect data subjects. In the AI context, this includes credit scoring models, personnel selection systems, dynamic pricing algorithms in insurance, and fraud detection systems. Data subjects have rights of access, rectification, cancellation and objection (ARCO rights), including the right to object to decisions based solely on automated processing.
