Compliance Essentials in Mexico: Data Protection, AML, Competition, Consumers and IP

Beyond tax and labor, a Mexican subsidiary is subject to several regulatory regimes that foreign head offices often overlook until a customer, bank or authority asks. This guide covers five of them: personal data protection, anti-money laundering, economic competition, consumer protection and trademarks. It closes with how to document compliance so that third parties can verify it.

A new Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) was published in the Federal Official Gazette (DOF) on 20 March 2025 and repealed the 2010 law. It applies to private individuals and companies that process personal data, except credit bureaus within their own regulatory scope and purely personal, non-commercial use. Its supervisory authority is the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno). It is no longer the INAI.

The core obligations are as follows. Process data according to the principles of lawfulness, purpose, loyalty, consent, quality, proportionality, information and accountability. Provide a privacy notice (aviso de privacidad) with the minimum content set by law: the controller's identity and address, the data processed (identifying sensitive data), the purposes, the options to limit use, how to exercise data rights and how changes will be communicated. When data is collected electronically, a short-form notice must be given at the point of collection, pointing to the full notice.

Consent may be tacit as a general rule. Financial or property data requires express consent. Sensitive data requires express written consent, given by handwritten or electronic signature or another authentication mechanism. Companies must keep administrative, technical and physical security measures, and must inform data subjects immediately of security breaches that significantly affect their property or moral rights.

Data subjects have rights of access, rectification, cancellation and objection (ARCO rights). The company must name a person or department to handle requests and must answer within 20 days, then implement the decision within 15 days. Each period can be extended once. Before transferring data to third parties in Mexico or abroad, the company must give them the privacy notice, and the recipient assumes the same obligations. Fines for the most serious violations can reach 320,000 times the UMA, Mexico's daily reference unit for fines, and can be doubled for sensitive data. The law also defines data-related crimes.

Mexico's Federal Law for the Prevention and Identification of Transactions with Illicit Proceeds (LFPIORPI) imposes AML duties on businesses that carry out "vulnerable activities" (actividades vulnerables). These include gaming and raffles; non-bank issuance of service or prepaid cards; habitual lending; real estate development and brokerage; trading in precious metals, jewelry and art; vehicle sales; armoring; cash-in-transit services; certain independent professional services; notarial services; donations received by non-profits; customs brokerage; certain property leases; and virtual asset exchange. Many of these activities trigger obligations only above value thresholds set in the law.

Businesses carrying out vulnerable activities must identify and verify their clients, collect information on the client's occupation, and identify beneficial owners. They must keep supporting records for at least 10 years and register in the vulnerable activities registry. They must also file notices (avisos) with the Ministry of Finance by the 17th of the month after the reportable transaction. Legal entities must appoint a compliance representative. Until one is appointed and accepted, the board or sole administrator is responsible.

Separately, every business must respect the ban on cash payments for certain transactions above set thresholds. These include real estate, vehicles, jewelry and art, and transfers of company shares, with thresholds expressed in multiples of the UMA.

The Federal Economic Competition Law is enforced by the National Antimonopoly Commission (Comisión Nacional Antimonopolio), created by the July 2025 reform. Agreements between actual or potential competitors to fix prices, restrict output, divide markets or rig bids are "absolute monopolistic practices". They are null and void and give rise to administrative sanctions, as well as civil and criminal liability.

Certain mergers and acquisitions must be authorized before closing. This applies when the transaction or the parties exceed thresholds expressed in multiples of the UMA, including transactions carried out abroad that have effects in Mexico. A notifiable transaction may not be closed, recorded in corporate books, formalized before a notary or registered until it is authorized or the legal review period has passed. If you are a foreign group buying or merging, check these thresholds early in the deal timetable.

If you sell to consumers, the Federal Consumer Protection Law applies, and its protections cannot be waived by contract. Providers must display the total price prominently, including taxes, commissions and any other charges. Advertising must be truthful, verifiable and not misleading.

Online sellers must keep consumer data confidential, use security measures, and give their physical address and contact details before the sale. Some standard-form contracts (contratos de adhesión) must be registered in advance with PROFECO, Mexico's consumer protection agency, when an official standard requires it. PROFECO must decide on registration within 30 business days.

Anyone may use a trademark in Mexico, but the exclusive right to use it is obtained only by registering it with the Mexican Institute of Industrial Property (Instituto Mexicano de la Propiedad Industrial, IMPI). A foreign registration does not automatically protect your brand in Mexico, so file before launching.

A registration lasts ten years from grant and can be renewed for further ten-year periods. Within the three months after the third anniversary of registration, the owner must file a declaration of real and effective use, listing the goods or services on which the mark is used. Without this declaration the registration lapses automatically, and protection continues only for the goods and services declared.

Customers, banks, investors and auditors increasingly ask Mexican subsidiaries for evidence of compliance, not just assurances. A compliance opinion (dictamen de cumplimiento) is a structured review of the entity's obligations against the applicable laws, with findings and supporting evidence. It gives third parties something they can check.

SDV Compliance 360 (https://sdvcompliance360.com) is SDV's compliance review for Mexican companies. It covers 21 compliance areas and 185 control points, including tax, labor, AML, data protection and corporate obligations. The resulting opinion can be verified online by the third parties you share it with. It does not replace the filings and authorizations described above, and no compliance opinion is a government certification. It is a way to document that those obligations are being met.

SDV can draft privacy notices and data-handling procedures under the 2025 law, assess whether your activities are vulnerable activities under the AML law and set up client identification and notices, flag transactions that may need merger clearance, review consumer-facing terms, and file trademark applications and declarations of use. For contentious or highly regulated matters, we coordinate with specialist counsel. This guide is general information, not legal advice.