AI Regulation Tracker  /  Data protection

Mexico Rebuilt Its Data Law, and It Now Covers Automated and AI Decisions

In force since March 21, 2025. Mexico replaced its Federal Law on the Protection of Personal Data Held by Private Parties with a new statute. Among the changes that matter for anyone running AI, the law gives people a right to object to purely automated decisions that significantly affect them, expects human review of those decisions, and requires privacy notices to disclose when data feeds automated or AI-driven processing.

By Anthony Guerriero  ·  The Leveraged Years Regulatory Research  ·  Published July 21, 2026  ·  Last updated July 21, 2026

Mexico did not amend its data-protection law. It replaced it. On March 20, 2025, a new Federal Law on the Protection of Personal Data Held by Private Parties was published in the Diario Oficial de la Federacion, and it took effect the following day. That is worth stating plainly because a lot of executives still think of Mexican data rules as the 2010 statute plus its regulation. That world is gone. The operative text for private-sector data handling is now this new law, and it was written for an environment where automated systems, profiling, and AI make decisions that used to be made by people.

For AI governance, the change that matters most is how the law treats automated decisions. It gives data subjects a right to oppose processing when their data is used in automated evaluation that significantly affects them and that runs, in the law's framing, "sin intervencion humana," without human intervention. The point is not that automation is banned. The point is that a person on the receiving end of a consequential automated decision can push back and ask for a human to be in the loop. That is the same principle that sits inside Europe's GDPR, and Mexico has now put a version of it into its own binding statute.

What does the law require for automated and AI decisions?

Read it as three linked duties. First, transparency at the front door: the privacy notice has to say, explicitly, when personal data will be used for automated decision-making or profiling. A generic notice that stays quiet about your algorithms no longer does the job. Second, a right of opposition: the individual can object to automated processing that evaluates personal aspects and significantly affects their interests, rights, or freedoms without meaningful human involvement. Third, and following from that, a human-review path: organizations need a real mechanism for a person to review a challenged automated decision, and that expectation bites hardest when the automated outcome is adverse to the individual. In practice this is the human-in-the-loop requirement, expressed through data-protection law rather than a standalone AI act.

Does this apply to US companies?

Yes, if you touch Mexican data subjects. The law reaches private parties that process the personal data of people in Mexico, and it does not care whether your servers or headquarters sit north of the border. A US lender scoring Mexican applicants, a US employer screening candidates in Mexico, a US platform pricing or profiling Mexican users, all of them are inside the frame. If any of those decisions run through a model with no human checkpoint, you now have three concrete obligations to meet: disclose the automated processing in your notice, honor the right to object, and stand up a human-review route. The commercial reality is that many US firms already built these controls for GDPR. If you did, extending them to Mexico is mostly a mapping exercise. If you did not, this is your prompt.

Read the status precisely

This is binding federal law, in force, so I am not going to soft-pedal it. That said, be careful about two things. The law is the framework; the operational detail of exactly how far the automated-decision right reaches and how human review must be documented will be worked out through the law's regulation and through enforcement practice, and Mexico's data-protection oversight itself was restructured recently. So treat the core rights as live obligations today while watching for implementing rules that sharpen the edges. The safe reading for an operator is not to wait. The rights exist now, the privacy-notice duty is concrete now, and the cost of retrofitting an automated-decision disclosure and a human-review workflow only goes up once a complaint lands.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how the LFPDPPP applies to your processing with qualified Mexican data-protection counsel.