Records / Laws and rulings

Mexico private-sector data protection law, Articles 2(XX), 35 and 36: transfers, inside or outside Mexico, go with the privacy notice and the recipient takes on the same duties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 2(XX), 35 and 36)

In Spanish. A 'transfer' is any communication of personal data inside or outside Mexico to someone other than the person, the controller or its processor, so a licence to a US buyer is a transfer. The holder must give the buyer the privacy notice and the purposes the person agreed to; the notice must say whether the person accepts the transfer; and the buyer takes on the same obligations as the holder. The Article 36 exceptions that let a transfer go ahead without consent (a law or treaty, medical care, group companies, a contract in the person's interest, public interest, legal claims, an existing legal relationship) do not fit a paid data licence on my reading. The law has no adequacy list, no approved-country rule and no separate rule for the United States; one rule covers domestic and foreign recipients.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text