Diagnostic

Rights of access, rectification, cancellation and objection: deadlines in business days

Twenty days to respond and fifteen to comply. A poorly handled request is the most common entry point to a proceeding before the authority.

LEXURE Data Protection Practice Team 7 min read Regulatory status verified in 2026

A person writes to the com­pany's gen­eral email address asking for their data to be deleted. No one knows whom to route it to, the mes­sage gets lost and, weeks later, an offi­cial demand from the author­ity arrives. This is how many per­sonal data pro­ceed­ings begin, with no secu­rity breach involved: all it takes is a request that no one han­dled in time.

What the law requires

The four rights. Under Arti­cles 22 to 26 of the Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares), the data sub­ject may access their data, request its rec­ti­fi­ca­tion when it is inac­cu­rate or incom­plete, request its can­cel­la­tion and object to its pro­cess­ing. Exer­cis­ing one right is not a pre­req­ui­site for exer­cis­ing another and does not pre­vent it (Arti­cle 21), and the data sub­ject may exer­cise these rights at any time, per­son­ally or through a rep­re­sen­ta­tive (Arti­cle 27).

The request. It must con­tain the data sub­ject's name and a means for receiv­ing noti­fi­ca­tions, the doc­u­ments prov­ing their iden­tity or that of their rep­re­sen­ta­tive, a descrip­tion of the data and of the right being exer­cised, and any ele­ment that helps locate the data (Arti­cle 28). For rec­ti­fi­ca­tion, the data sub­ject must indi­cate the changes requested and pro­vide sup­port­ing doc­u­men­ta­tion (Arti­cle 30).

The dead­lines. The data con­troller must com­mu­ni­cate its deci­sion within a max­i­mum of twenty days from receipt of the request and, if the request is granted, give effect to it within the fif­teen days fol­low­ing the response. Both dead­lines may be extended only once for an equal period, when cir­cum­stances jus­tify it (Arti­cle 31). For pur­poses of the law, days are busi­ness days. For the right of access, deliv­ery is sub­ject to prior proof of iden­tity.

How access is pro­vided. The data con­troller makes the data avail­able to the data sub­ject or deliv­ers it through plain copies, elec­tronic doc­u­ments or another means indi­cated in the pri­vacy notice (Arti­cle 32).

Can­cel­la­tion is not always imme­di­ate. Can­cel­la­tion trig­gers a block­ing period before final dele­tion (Arti­cle 24), and the data con­troller is not required to cancel in the cases listed in Arti­cle 25, for exam­ple when the data must be retained under a legal pro­vi­sion or to ful­fill obli­ga­tions aris­ing from the rela­tion­ship with the data sub­ject.

When the request may be denied. The data con­troller may deny the exer­cise of the right when the requester's iden­tity has not been proven, the data is not in its pos­ses­sion, the rights of a third party would be harmed, there is a legal imped­i­ment or a deci­sion by an author­ity, or the rec­ti­fi­ca­tion, can­cel­la­tion or objec­tion has already been car­ried out. The denial may be par­tial and must be com­mu­ni­cated with its rea­sons, within the same dead­lines and through the same means as the request (Arti­cle 33).

The cost. Exer­cis­ing these rights is free of charge; only repro­duc­tion, copy­ing or ship­ping costs may be charged. If the data sub­ject repeats the request within less than twelve months, the cost may not exceed three times the Unit of Mea­sure­ment and Update (UMA), that is, 3 UMA (MXN 351.93), unless there are sub­stan­tial changes to the notice (Arti­cle 34).

What fol­lows if the data sub­ject is not sat­is­fied. The data sub­ject may file a rights pro­tec­tion request with the Min­istry of Anti-Cor­rup­tion and Good Gov­er­nance (Sec­re­taría Anti­cor­rup­ción y Buen Gob­ierno) (Arti­cle 40). The Min­istry must issue its deci­sion within a max­i­mum of fifty days, extend­able once (Arti­cle 42), and if the deci­sion favors the data sub­ject, the data con­troller must comply within ten days and inform the author­ity within the fol­low­ing ten (Arti­cle 43).

What to do and by when

  1. Pub­lish in your pri­vacy notice a spe­cific chan­nel for sub­mit­ting requests and the pro­ce­dure for doing so.
  2. Keep a log of each request with its date of receipt, response dead­line and com­pli­ance date, cal­cu­lated in busi­ness days.
  3. Define who ver­i­fies the requester's iden­tity, and with which doc­u­ments, before any infor­ma­tion is deliv­ered.
  4. Pre­pare tem­plate responses for each right, includ­ing a denial based on the grounds in Arti­cle 33.
  5. Iden­tify which data must be retained under a legal pro­vi­sion, so that you apply the block­ing period and the excep­tions to can­cel­la­tion cor­rectly.
  6. Route any request received through a chan­nel other than the offi­cial one on the same day it arrives, because the dead­line runs from receipt.

Recommendations to mitigate risk

Fail­ing to respond to a request with­out a well-founded reason leads to a formal warn­ing order­ing the com­pany to comply (Arti­cles 58, sec­tion I, and 59, sec­tion I). Dis­re­gard­ing that warn­ing, acting neg­li­gently in pro­cess­ing the request or keep­ing inac­cu­rate data with­out rec­ti­fy­ing it is pun­ish­able by a fine of 100 to 160,000 UMA (MXN 11,731 to MXN 18,769,600), under Arti­cles 58, sec­tions II, VI and VII, and 59, sec­tion II. Will­fully stat­ing that data does not exist when it is in fact in the com­pany's data­bases falls within the same range (Arti­cle 58, sec­tion III). Con­tin­u­ing to use the data after the data sub­ject requested that it cease is pun­ish­able by a fine of 200 to 320,000 UMA (MXN 23,462 to MXN 37,539,200), under Arti­cles 58, sec­tion XVI, and 59, sec­tion III.

Self-assessment

Answer yes or no for your own com­pany.

  1. Does your pri­vacy notice indi­cate a spe­cific chan­nel for sub­mit­ting requests?
  2. Do you keep a log of requests with their dead­lines in busi­ness days?
  3. Do you know who ver­i­fies the requester's iden­tity before data is deliv­ered?
  4. Do you have tem­plate responses for each right, includ­ing a well-founded denial?
  5. Do you know which data you must retain by law even if the data sub­ject requests its can­cel­la­tion?
  6. Are requests that arrive at other email addresses or on social media routed the same day?

How we approach it at LEXURE

We design the com­plete request han­dling pro­ce­dure: chan­nel, log, iden­tity ver­i­fi­ca­tion, tem­plate responses, dead­line cal­en­dar and reten­tion rules. We train the des­ig­nated person or depart­ment and, when a com­plex request arrives, we sup­port the response so that it with­stands review by the author­ity.

If your com­pany receives requests from cus­tomers, employ­ees or users and does not have a writ­ten pro­ce­dure, sched­ule a diag­nos­tic meet­ing with us.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Law on the Protection of Personal Data Held by Private Parties, Articles 21 to 34, 40, 42, 43, 58, sections I, II, III, VI, VII and XVI, and 59, sections I to III. Current text (opens in a new tab)
  2. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes