Impact note

Automated decisions and artificial intelligence: the new right to object

If your company scores, screens or makes decisions about individuals with an automated model, the 2025 law gave those individuals a right they did not have before.

LEXURE Data Protection Practice Team 6 min read Regulatory status verified in 2026

Many com­pa­nies use auto­mated models to decide who is granted credit, which can­di­date moves on to an inter­view or which cus­tomer is flagged as a fraud risk. Until 2025, Mex­i­can per­sonal data law said noth­ing spe­cific about those deci­sions. The law in force does, and adapt­ing to it requires redesign­ing pro­cesses as well as doc­u­ments.

What changes for your company

The new ground for objec­tion. Arti­cle 26, sec­tion II, of the Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares) allows the data sub­ject to object to the pro­cess­ing of their data, or to demand that it cease, when the data is sub­ject to auto­mated pro­cess­ing that pro­duces unwanted effects for them or sig­nif­i­cantly affects their inter­ests, rights or free­doms, and that is intended to eval­u­ate per­sonal aspects with­out human inter­ven­tion or to ana­lyze or pre­dict their pro­fes­sional per­for­mance, eco­nomic sit­u­a­tion, health, sexual pref­er­ences, reli­a­bil­ity or behav­ior.

Which deci­sions fall within it. The pro­vi­sion requires three ele­ments to be present together: auto­mated pro­cess­ing, a sig­nif­i­cant effect on the indi­vid­ual and the eval­u­a­tion of per­sonal aspects with­out human inter­ven­tion. A model that auto­mat­i­cally denies credit, rejects a job appli­ca­tion or blocks an account based on a risk score meets, in prin­ci­ple, all three. By con­trast, a tool that only orga­nizes infor­ma­tion so that a person can decide, with real abil­ity to change the out­come, is unlikely to meet them.

What the law does not say. The 2025 law does not estab­lish a gen­eral right to obtain an expla­na­tion of the algo­rithm or to demand human review as such, nor does it require impact assess­ments before a model is used. It grants the right to object, which is pro­cessed under the pro­ce­dure and dead­lines for the rights of access, rec­ti­fi­ca­tion, can­cel­la­tion and objec­tion: a response within a max­i­mum of twenty busi­ness days and imple­men­ta­tion within the fol­low­ing fif­teen, extend­able once (Arti­cle 31). Even so, to handle an objec­tion with­out halt­ing the busi­ness, the sound­est approach is to have an effec­tive chan­nel for human review.

The limit of the right. Objec­tion is not avail­able when the pro­cess­ing is nec­es­sary to ful­fill a legal obli­ga­tion imposed on the data con­troller (Arti­cle 26, last para­graph). An auto­mated process that the com­pany car­ries out by man­date of law, for exam­ple to iden­tify cus­tomers in com­pli­ance with anti-money laun­der­ing rules (pre­ven­tion of trans­ac­tions with funds of illicit origin), may fall out­side the right, but that neces­sity must be demon­stra­ble.

What the notice must dis­close. If the com­pany uses data for auto­mated eval­u­a­tions, that pur­pose must be stated in the pri­vacy notice, and the notice must indi­cate the means to exer­cise the right to object (Arti­cle 15, sec­tions III and V). Using data for a pur­pose that was not dis­closed requires obtain­ing con­sent again (Arti­cle 11).

What to do and by when

The right has been in force since March 21, 2025.

  1. Inven­tory the pro­cesses in which a system decides or makes rec­om­men­da­tions about indi­vid­u­als: credit, col­lec­tions, hiring, per­for­mance, per­son­al­ized pric­ing and fraud pre­ven­tion.
  2. Clas­sify each process accord­ing to whether or not there is human inter­ven­tion with real abil­ity to modify the deci­sion.
  3. For pro­cesses with­out human inter­ven­tion, design a chan­nel for review by a person that can be acti­vated when the data sub­ject objects.
  4. Doc­u­ment which pro­cesses respond to a legal obli­ga­tion, with the legal basis that sup­ports them.
  5. Update the pri­vacy notice to dis­close the auto­mated eval­u­a­tion pur­pose and the means to object.
  6. If the model is pro­vided by a third party, make sure by con­tract that the vendor will allow you to sus­pend auto­mated pro­cess­ing for a spe­cific data sub­ject.

Recommendations to mitigate risk

If the com­pany fails to handle an objec­tion, the author­ity may issue a formal warn­ing order­ing it to comply, and dis­re­gard­ing the warn­ing or pro­cess­ing requests neg­li­gently is pun­ish­able by a fine of 100 to 160,000 Units of Mea­sure­ment and Update, or UMA (MXN 11,731 to MXN 18,769,600), under Arti­cles 58, sec­tions I, II and VII, and 59, sec­tions I and II. Con­tin­u­ing to use the data after the data sub­ject or the Min­istry of Anti-Cor­rup­tion and Good Gov­er­nance (Sec­re­taría Anti­cor­rup­ción y Buen Gob­ierno) requested that it cease, or pro­cess­ing the data in a way that pre­vents the exer­cise of these rights, is pun­ish­able by a fine of 200 to 320,000 UMA (MXN 23,462 to MXN 37,539,200), under Arti­cles 58, sec­tions XVI and XVII, and 59, sec­tion III. If the model pro­cesses sen­si­tive data, such as health infor­ma­tion, the penal­ties may be increased up to twofold (Arti­cle 59, sec­tion IV).

How we approach it at LEXURE

We map your com­pany's auto­mated pro­cesses, iden­tify which ones fall under Arti­cle 26 and, together with your team, design the human review chan­nel, the notice lan­guage and the con­tracts with model ven­dors. With that frame­work, your com­pany can keep automat­ing and has a clear pro­ce­dure for han­dling a data sub­ject who objects.

If your com­pany makes deci­sions about indi­vid­u­als with the sup­port of auto­mated models, sched­ule a diag­nos­tic meet­ing with us.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Law on the Protection of Personal Data Held by Private Parties, Articles 11, 15, sections III and V, 26, 31, 58, sections I, II, VII, XVI and XVII, and 59. Current text (opens in a new tab)
  2. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes