Privacy notice: what the law requires before you write a line of code

If you collect one personal data point, you're already a "responsible party"

You don't need to sell anything or run a large company. Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) applies to any private individual or company that processes personal data — the law calls them "regulated subjects":

"Private individuals or legal entities that carry out the processing of personal data" (art. 2, section XVI)

A contact form, a checkout, an analytics cookie, a mailing list: all of that counts as "processing of personal data." The law exempts only two specific cases — credit information companies (regulated separately) and anyone collecting data strictly for personal use, without disclosure or commercial purposes (art. 1). Outside those two cases, if your site asks for a data point, the law applies to you.

What exactly is a privacy notice?

The law defines it as:

"A document made available to the data subject in physical, electronic, or any other format generated by the responsible party, from the moment their personal data is collected, in order to inform them of the purposes of its processing" (art. 2, section I)

And having one isn't optional or a "best practice" — it's a direct legal obligation (art. 14).

What it must contain, at minimum

Article 15 lists this as a closed set — not suggestions, but the minimum required content: identity and address of the responsible party; the personal data being processed, flagging which is sensitive; the purposes of processing, distinguishing which require consent; the options offered to limit use or disclosure of the data; the mechanisms to exercise ARCO rights (access, rectification, cancellation, opposition); and the procedure for notifying changes to the notice itself.

How it must be delivered on a site or app

When data is collected electronically — true of virtually any website or app — article 16, section II is explicit: a simplified notice covering at least sections I through IV of article 15 is enough, as long as it states where to find the full notice. That's literally the "short banner + link to full policy" pattern you already know.

What happens if it's omitted

Article 58, section V classifies as an infraction "omitting from the privacy notice any or all of the elements referred to in article 15." The penalty, per article 59, section II, is a fine of 100 to 160,000 Units of Measurement and Update (UMA) — and this is only one of several infractions the law contemplates, not the only way to fall short of compliance.

A law that changed substantially not long ago

Something many articles on this topic still don't reflect: the LFPDPPP in force today is not the 2010 law you probably know by name. On March 20, 2025, a New LFPDPPP was published that fully abrogated the previous one, taking effect the next day, with an additional reform published November 14, 2025 (the text cited here). Among other changes, the competent authority changed — no longer the now-defunct INAI, but the Anti-Corruption and Good Government Secretariat.

Where code comes in

This is the part almost nobody connects well: a privacy notice isn't a standalone document legal drafts and marketing pastes in. It has to describe exactly what the code does — what fields the form captures, what cookies fire, which third-party services (analytics, payments, CRM) receive data transfers. The most common compliance failure isn't a badly written notice — it's an accurate notice that no longer matches what the site actually collects, because the code changed and the notice didn't. Keeping them in sync is, in practice, as much the responsibility of whoever writes the code as whoever writes the notice.

This article explains the general content of the LFPDPPP for informational and educational purposes. It does not constitute legal advice for a specific case and does not replace review of your specific privacy notice by a professional.