If a company in Mexico uses your personal data without consent, ignores your request to find out what it holds about you, shared your data without permission or suffered a breach that affected you, you have rights you can enforce. Castro Defense advises and represents individuals across Mexico, including foreign residents and customers of Mexican companies, in personal data protection: exercising ARCO rights, filing complaints with the authority and claiming for harm caused. The whole process with us is online and follows Mexican law.
No upfront fees: we only get paid if we recover. When your matter seeks compensation or to spare you a loss, we charge only once that benefit materializes: a percentage of what is recovered, set by the complexity of the case. You cover only related costs, such as expert reports or supplies. If your matter does not seek a financial benefit, fees are agreed case by case. The terms are set out in writing in the contract you review before signing. We do not promise results.
Which law protects your personal data?
The Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), published in Mexico’s official gazette on March 20, 2025, governs private companies and individuals that process personal data. It is enforced by the Secretariat for Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno). Data held by government bodies is governed by a separate law, the General Law on the Protection of Personal Data Held by Obligated Subjects.
Among other rules, the LFPDPPP provides that:
- Processing requires your consent, except as the law allows. Financial or property data requires express consent, and sensitive data express written consent (arts. 7 and 8).
- The company must tell you, through a privacy notice (aviso de privacidad), what data it processes and why (arts. 14 and 15).
- The company must protect your data with administrative, technical and physical security measures (art. 18) and inform you immediately of breaches that significantly affect your property or moral rights (art. 19).
Your ARCO rights
- Access: find out what data the company holds about you and how it is used.
- Rectification: correct inaccurate, incomplete or outdated data.
- Cancellation: ask for your data to be removed from the company’s files and systems.
- Objection: ask the company to stop processing your data for a legitimate reason, or when automated processing has unwanted effects on you.
You can also withdraw any consent you have given at any time (art. 7).
How are they enforced?
- Request to the company. It must include your name and a way to receive the reply, proof of identity, a description of the data and the right you are exercising (art. 28).
- Company reply. It has 20 business days to reply and 15 more to comply if the request is granted, extendable once (art. 31). Exercising these rights is free, except for reproduction or shipping costs (art. 34).
- Data protection request. If there is no reply or you disagree, you can go to the Secretariat for Anti-Corruption and Good Governance within 15 business days of the reply or of the missed deadline (art. 40).
- Sanctions and damages. The authority can sanction violations (arts. 58 and 59), and anyone harmed can claim the compensation that applies (art. 53). Some conduct, such as processing data through deception for undue profit, is a crime (arts. 62 and 63).
How does it work online?
- Case evaluation form. Tell us which company processes your data and what happened.
- Document review. A lawyer reviews your case and tells you which route fits and which deadlines apply. Response time: 48 calendar hours, or 1 to 4 hours in urgent matters.
- Contract and power of attorney as a PDF. You sign with your e.firma (the advanced electronic signature issued by Mexico’s tax authority, SAT) or another electronic signature. The law allows ARCO rights to be exercised through a representative (art. 21).
- Case updates. We report every reply from the company and the authority. Channel: channel and frequency of updates.
Evidence to gather
- Emails, messages, calls or posts showing how your data was used.
- The company’s privacy notice, if you have it.
- Your earlier requests and any replies.
- Any breach or security incident notice.
When the evidence is digital, our digital forensics service can document it with chain of custody so it holds up before the authority.
How to know you are dealing with real lawyers
Attorneys who handle these matters: names and cédula profesional numbers. Verify any professional license in the National Registry of Professionals of Mexico’s Ministry of Public Education. Your data is handled under our privacy notice. See the other areas of our legal defense practice.
Tell us about your case
This content is for information only and is not legal advice for a specific case. The outcome of any proceeding depends on the facts, the evidence and the authority’s decision; Castro Defense does not guarantee results.
Official sources
- Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), arts. 2, 7, 8, 14, 15, 18, 19, 21 to 34, 40, 53, 58, 59, 62 and 63. Chamber of Deputies, DOF March 20, 2025 (Spanish).
- General Law on the Protection of Personal Data Held by Obligated Subjects (LGPDPPSO). Chamber of Deputies (Spanish).
- Secretariat for Anti-Corruption and Good Governance. Government of Mexico (Spanish).
Frequently asked questions
What are ARCO rights in Mexico?
They are the rights of access, rectification, cancellation and objection regarding your personal data. They let you find out what data a company holds about you, correct it, ask for it to be deleted or ask the company to stop using it, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (arts. 2 and 21 to 26).
How long does a company have to answer an ARCO request?
It must reply within a maximum of 20 business days from receipt and, if the request is granted, carry it out within the following 15 business days. Each deadline may be extended once for an equal period when justified (art. 31).
What if the company does not reply or refuses?
You can file a data protection request with Mexico's Secretariat for Anti-Corruption and Good Governance within 15 business days of the reply or, if there was none, once the reply deadline has passed (art. 40).
Can I claim damages for misuse of my data?
The law recognizes that anyone who suffers damage to their property or rights because of a breach of the law may bring the relevant actions to obtain compensation, under the applicable legal provisions (art. 53). Whether it applies and how much depends on the evidence of harm.
Does it cost anything to exercise ARCO rights?
Exercising ARCO rights is free. The company may only charge reproduction, copying or shipping costs (art. 34).