Diagnostic

Privacy notice: the six elements the 2025 law requires and how to review them

The privacy notice is the most frequently copied personal data document and the one an authority can review most easily. Six elements determine whether it complies.

LEXURE Data Protection Practice Team 7 min read Regulatory status verified in 2026

The pri­vacy notice is often han­dled by copy­ing another com­pany's notice and chang­ing the name. It is the most vis­i­ble per­sonal data doc­u­ment and the first one the author­ity requests. It is also the one that most easily reveals that the com­pany does not know what data it pro­cesses or why. Review­ing it against the 2025 law takes little time and avoids one of the eas­i­est fines to impose.

What the law requires

The duty to inform. Under Arti­cle 14 of the Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares), the data con­troller must inform data sub­jects, through the pri­vacy notice, what infor­ma­tion it col­lects and for what pur­poses.

The min­i­mum con­tent. The notice must con­tain, at a min­i­mum (Arti­cle 15):

  1. The iden­tity and address of the data con­troller.
  2. The per­sonal data to be pro­cessed, iden­ti­fy­ing any sen­si­tive data.
  3. The pur­poses of the pro­cess­ing, dis­tin­guish­ing those that require the data sub­ject's con­sent.
  4. The options and means to limit the use or dis­clo­sure of the data.
  5. The mech­a­nisms, means and pro­ce­dures to exer­cise the rights of access, rec­ti­fi­ca­tion, can­cel­la­tion and objec­tion.
  6. The pro­ce­dure and means to com­mu­ni­cate changes to the notice.

How and when it is deliv­ered. If the data is obtained in person in printed form, the notice is pro­vided at that moment. If it is obtained through elec­tronic means or any other tech­nol­ogy, it is pro­vided in sim­pli­fied form, with at least the first four ele­ments and an indi­ca­tion of where the full notice can be con­sulted (Arti­cle 16). If the data was not obtained directly from the data sub­ject, the notice must be pro­vided at the first con­tact (Arti­cle 17).

Con­sent. As a gen­eral rule, tacit con­sent is suf­fi­cient: if the notice was made avail­able and the data sub­ject does not object, con­sent is deemed given (Arti­cle 7). How­ever, finan­cial or asset data requires express con­sent, sub­ject to the excep­tions in the law, and sen­si­tive data requires express writ­ten con­sent, by hand­writ­ten sig­na­ture, elec­tronic sig­na­ture or another authen­ti­ca­tion mech­a­nism (Arti­cles 7 and 8). If the com­pany wants to use the data for a pur­pose other than the one dis­closed, it must obtain con­sent again (Arti­cle 11).

Trans­fers. If the data will be shared with third par­ties other than pro­ces­sors, the notice must include a clause indi­cat­ing whether or not the data sub­ject accepts the trans­fer (Arti­cle 35), except in the cases where the law allows a trans­fer with­out con­sent, such as a trans­fer to com­pa­nies in the same group that oper­ate under the same poli­cies (Arti­cle 36).

What the law does not men­tion. The law in force does not reg­u­late the so-called “short notice,” which comes from guide­lines issued under the former regime. Nor does Mexico have a prior con­sent rule for cook­ies equiv­a­lent to the Euro­pean one: the 2011 Reg­u­la­tions (Reglamento de la Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares) require inform­ing users, at the time of col­lec­tion, about the use of tech­nolo­gies that col­lect data auto­mat­i­cally and how to dis­able them (Arti­cle 14, third para­graph, of the Reg­u­la­tions). It is rea­son­able to use those tools as a best prac­tice, pro­vided they are not cited as if they were the law in force.

What to do and by when

  1. Build an actual inven­tory of the data your com­pany col­lects through each chan­nel: web­site, apps, forms, con­tracts, human resources and video sur­veil­lance.
  2. Draft or cor­rect the full notice so that it con­tains the six ele­ments of Arti­cle 15 and reflects that inven­tory, with­out generic pur­poses.
  3. Pre­pare a sim­pli­fied notice for each elec­tronic chan­nel, with the first four ele­ments and the link to the full notice.
  4. Sep­a­rate the pur­poses that require con­sent, such as mar­ket­ing, from those nec­es­sary for the rela­tion­ship with the data sub­ject.
  5. Obtain express con­sent for finan­cial or asset data and express writ­ten con­sent for sen­si­tive data.
  6. Update the legal cita­tions to the 2025 num­ber­ing and remove ref­er­ences to the National Insti­tute for Trans­parency, Access to Infor­ma­tion and Per­sonal Data Pro­tec­tion (INAI).
  7. Keep evi­dence that the notice was made avail­able in each chan­nel, with date and ver­sion.

Recommendations to mitigate risk

Omit­ting some or all of the ele­ments of Arti­cle 15 from the notice is pun­ish­able by a fine of 100 to 160,000 Units of Mea­sure­ment and Update, or UMA (MXN 11,731 to MXN 18,769,600), under Arti­cles 58, sec­tion V, and 59, sec­tion II. If the notice is not truth­ful about the pur­poses and the com­pany uses the data for some­thing else, the con­duct may qual­ify as a sub­stan­tial change of pur­pose with­out con­sent (Arti­cle 58, sec­tion IX), or as a trans­fer with­out com­mu­ni­cat­ing the notice to the recip­i­ent (sec­tion X). Both are pun­ish­able by a fine of 200 to 320,000 UMA (MXN 23,462 to MXN 37,539,200), under sec­tion III of Arti­cle 59. The author­ity sets the amount of each fine con­sid­er­ing, among other fac­tors, the nature of the data and the eco­nomic capac­ity of the data con­troller (Arti­cle 60).

Self-assessment

Answer yes or no for your own com­pany.

  1. Does your full notice con­tain the six ele­ments of Arti­cle 15?
  2. Do you have a sim­pli­fied notice in each elec­tronic chan­nel where you col­lect data?
  3. Does the notice iden­tify which sen­si­tive data you process, if you process any?
  4. Does it dis­tin­guish the pur­poses that require con­sent from those nec­es­sary for the rela­tion­ship?
  5. Do you obtain express writ­ten con­sent for sen­si­tive data?
  6. Do the legal cita­tions in your notice cor­re­spond to the 2025 law?
  7. Can you show, with date and ver­sion, that the notice was avail­able in each chan­nel?

How we approach it at LEXURE

We start from your com­pany's data inven­tory: we map what it col­lects, through which chan­nel and for what pur­pose, and with that map we draft the full notice, the sim­pli­fied notices and the con­sent mech­a­nisms. We also put in place the pro­ce­dure to update the notice every time a process changes, because that is when notices tend to stop reflect­ing real­ity.

If your pri­vacy notice pre­dates the 2025 law or was copied from another com­pany, sched­ule a diag­nos­tic meet­ing with us.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Law on the Protection of Personal Data Held by Private Parties, Articles 7, 8, 11, 14, 15, 16, 17, 35, 36, 58, sections V, IX and X, 59 and 60. Current text (opens in a new tab)
  2. Regulations under the Federal Law on the Protection of Personal Data Held by Private Parties, Article 14. Published text (opens in a new tab)
  3. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes