Diagnostic

Legal incident response protocol: the decisions that cannot be improvised

The technical team contains the attack. But notifying data subjects, preserving evidence, filing a criminal complaint and responding to customers are legal decisions with consequences.

LEXURE Cybersecurity Law Practice Team 7 min read Regulatory status verified in 2026

In the first hours of a com­puter secu­rity inci­dent, the com­pany makes deci­sions it will not be able to undo later: what gets shut down, what gets deleted, who is noti­fied and what is said. Many of them have legal con­se­quences, and a writ­ten, rehearsed pro­to­col keeps them from being made under pres­sure and with­out infor­ma­tion.

What the law requires

Toward data sub­jects. Under Arti­cle 19 of the Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares), if the breach sig­nif­i­cantly affects their eco­nomic or moral rights, the con­troller must inform them imme­di­ately. The law sets no dead­line in hours and no duty to notify the author­ity.

Regard­ing the com­pany’s own secu­rity. The duty to main­tain secu­rity mea­sures pro­por­tion­ate to the risk is ongo­ing (Arti­cle 18). After an inci­dent, the root cause anal­y­sis and the cor­rec­tive actions are the best evi­dence that the com­pany meets that duty. The 2011 Reg­u­la­tions, whose force is debat­able, require this expressly (Arti­cle 66 of the Reg­u­la­tions), and even with­out that text it is the con­duct the author­ity expects.

Regard­ing the crime. The Fed­eral Crim­i­nal Code (Código Penal Fed­eral) pun­ishes anyone who, with­out autho­riza­tion, mod­i­fies, destroys or causes the loss of infor­ma­tion con­tained in sys­tems pro­tected by a secu­rity mech­a­nism with six months to two years in prison and one hun­dred to three hun­dred day-fines (días multa), and anyone who, with­out autho­riza­tion, learns of or copies that infor­ma­tion with three months to one year in prison and fifty to one hun­dred fifty day-fines (Arti­cle 211 bis 1). A day-fine equals the con­victed person’s net daily income (Arti­cle 29). Penal­ties are higher when the sys­tems belong to finan­cial system insti­tu­tions (Arti­cles 211 bis 4 and 211 bis 5). The law does not require a pri­vate com­pany that is the victim to file a crim­i­nal com­plaint in every case, but if it decides to do so it needs pre­served evi­dence.

Regard­ing per­son­nel. Under the Fed­eral Labor Law (Ley Fed­eral del Tra­bajo), an employee’s dis­clo­sure of man­u­fac­tur­ing secrets or of con­fi­den­tial mat­ters, to the com­pany’s detri­ment, is cause for ter­mi­nat­ing the employ­ment rela­tion­ship with­out lia­bil­ity for the employer (Arti­cle 47, sec­tion IX). If the inci­dent was caused by an insider, the com­pany must act within the labor law dead­lines and with the for­mal­i­ties of the ter­mi­na­tion notice.

Regard­ing the ver­i­fy­ing author­ity. The Min­istry of Anti-Cor­rup­tion and Good Gov­er­nance (Sec­re­taría Anti­cor­rup­ción y Buen Gob­ierno) may open a ver­i­fi­ca­tion pro­ceed­ing on its own ini­tia­tive when it pre­sumes, on rea­soned and jus­ti­fied grounds, a vio­la­tion of the law, and in that pro­ceed­ing it has access to the infor­ma­tion and doc­u­men­ta­tion it con­sid­ers nec­es­sary (Arti­cles 54 and 55). A pub­licly known inci­dent is a likely reason for ver­i­fi­ca­tion, and obstruct­ing ver­i­fi­ca­tion acts is in itself an infrac­tion (Arti­cle 58, sec­tion XIV), regard­less of what is con­cluded about the inci­dent.

Regard­ing cus­tomers and ven­dors. Con­tracts often impose notice, coop­er­a­tion and audit dead­lines after an inci­dent. Breach­ing them cre­ates con­trac­tual lia­bil­ity sep­a­rate from the admin­is­tra­tive penalty.

What to do and by when

  1. Form a response com­mit­tee with people from tech­nol­ogy, man­age­ment, legal and com­mu­ni­ca­tions, with alter­nates and con­tact details kept out­side the com­pany’s sys­tems.
  2. Define the cri­te­ria for clas­si­fy­ing the sever­ity of an inci­dent and for decid­ing whether the impact on data sub­jects is sig­nif­i­cant.
  3. Set evi­dence preser­va­tion rules to apply before restor­ing sys­tems: foren­sic copies, activ­ity logs and a deci­sion log record­ing the time and the person respon­si­ble.
  4. Pre­pare notice tem­plates for data sub­jects, for cus­tomers with con­trac­tual notice obli­ga­tions and for insur­ers, if you have a policy.
  5. Define who decides to file a com­plaint with the Public Pros­e­cu­tor’s Office (Min­is­te­rio Público) and with what evi­dence.
  6. Plan the labor pro­ce­dure in case the inci­dent involves your own per­son­nel.
  7. Rehearse the pro­to­col at least once a year with a sim­u­lated case and doc­u­ment the improve­ments.
  8. After each inci­dent, pre­pare a root cause anal­y­sis and a cor­rec­tive action plan approved by man­age­ment.
  9. Des­ig­nate who will deal with the author­ity if it opens a ver­i­fi­ca­tion pro­ceed­ing and pre­pare the index of doc­u­ments that would be deliv­ered to it.

Recommendations to mitigate risk

If the inci­dent is attrib­ut­able to the com­pany, the per­sonal data fine ranges from 200 to 320,000 times the Unit of Mea­sure­ment and Update (UMA), equiv­a­lent to MXN 23,462 to MXN 37,539,200, under Arti­cle 58, sec­tion XI, and Arti­cle 59, sec­tion III. An impro­vised response increases that risk. If sys­tems are restored with­out pre­serv­ing evi­dence, the com­pany loses the abil­ity to show what hap­pened, both before the author­ity and in a crim­i­nal com­plaint. Late or incom­plete notice to data sub­jects opens the door to claims for dam­ages that could have been avoided (Arti­cle 53), and a hasty public state­ment may con­tra­dict what is later estab­lished and com­pro­mise the defense. If a ver­i­fi­ca­tion pro­ceed­ing fol­lows, a dis­or­ga­nized response or a fail­ure to deliver infor­ma­tion may con­sti­tute the obstruc­tion described in Arti­cle 58, sec­tion XIV, pun­ish­able within the same range of 200 to 320,000 UMA (MXN 23,462 to MXN 37,539,200), under Arti­cle 59, sec­tion III.

Self-assessment

Answer yes or no for your own com­pany.

  1. Do you have an inci­dent response com­mit­tee with mem­bers and alter­nates des­ig­nated in writ­ing?
  2. Have you defined the cri­te­ria for decid­ing whether a breach is sig­nif­i­cant?
  3. Does your team know what evi­dence to pre­serve before restor­ing sys­tems?
  4. Do you have notice tem­plates for data sub­jects and cus­tomers?
  5. Do you know which con­tracts impose notice dead­lines on you after an inci­dent?
  6. Have you defined who decides to file a crim­i­nal com­plaint?
  7. Have you rehearsed the pro­to­col in the past year?

How we approach it at LEXURE

We draft the legal inci­dent response pro­to­col and inte­grate it with your team’s tech­ni­cal plan: com­mit­tee, deci­sion cri­te­ria, evi­dence rules, notice tem­plates and a matrix of con­trac­tual obli­ga­tions. We run a sim­u­lated exer­cise with man­age­ment and, if a real inci­dent occurs, we sup­port the legal deci­sions from the first hour.

If your com­pany has a tech­ni­cal plan but no legal pro­to­col, sched­ule a diag­nos­tic meet­ing with us.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Law on the Protection of Personal Data Held by Private Parties, Articles 18, 19, 53, 54, 55, 58, sections XI and XIV, and 59, section III. Current text (opens in a new tab)
  2. Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties (Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares), Article 66. Published text (opens in a new tab)
  3. Federal Criminal Code, Articles 29, 211 bis 1, 211 bis 4 and 211 bis 5. Current text (opens in a new tab)
  4. Federal Labor Law, Article 47, section IX. Current text (opens in a new tab)
  5. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes