Mexico: Privacy

When a company collects biometric data in Mexico, one important question that is often asked is how Mexico’s evolving privacy framework treats that information, and what obligations or risks come with it. The concern is well founded, because biometric data is one of the most sensitive categories of personal information, and Mexico’s recent changes to implement the biometric CURP to citizens have only increased discussion around the topic.

On 20 March 2025, the Decree issuing laws on transparency and protection of personal data was published in the Federal Official Gazette, which became effective the day after its publication.

The legal framework for data protection is found in Articles 6 and 16 of the Mexican Constitution, as well as in the new Federal Law for the Protection of Personal Data Held by Private Parties, published on March 20, 2025...