Diagnostic

Critical cloud providers: what your company still owes when the data is hosted elsewhere

Moving to the cloud transfers the operations, not the liability. Before the authority and the data subject, the data controller is still your company.

LEXURE Commercial Contracts Practice Team 7 min read Regulatory status verified in 2026

Today it is common for a com­pany to host its crit­i­cal infor­ma­tion on third-party ser­vices, and also to assume that, in doing so, the lia­bil­ity left along with the data. The 2025 data pro­tec­tion law says oth­er­wise: the provider pro­cesses the infor­ma­tion on the com­pany’s behalf, and it is the com­pany that is liable.

What the law requires

Con­troller and pro­ces­sor. The Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares, LFPDPPP), pub­lished in the Offi­cial Gazette of the Fed­er­a­tion (DOF) on March 20, 2025, dis­tin­guishes the con­troller (respon­s­able), which decides on the pro­cess­ing, from the pro­ces­sor (per­sona encar­gada), which pro­cesses per­sonal data on the con­troller’s behalf (Arti­cle 2, sec­tion XII). Deliv­er­ing data to the pro­ces­sor is not a trans­fer: the law defines a trans­fer as a com­mu­ni­ca­tion to a person other than the data sub­ject, the con­troller, or the pro­ces­sor (Arti­cle 2, sec­tion XX). For that reason, a cloud provider that only hosts and pro­cesses data on your com­pany’s instruc­tions does not need the data sub­ject’s con­sent to receive the data, but nei­ther does it assume the con­troller’s obli­ga­tions before the author­ity.

What your com­pany must guar­an­tee. The con­troller must estab­lish and main­tain admin­is­tra­tive, tech­ni­cal, and phys­i­cal secu­rity mea­sures, and may not adopt mea­sures weaker than those it main­tains for its own infor­ma­tion; it must take into account the risk, the con­se­quences for data sub­jects, the sen­si­tiv­ity of the data, and tech­no­log­i­cal devel­op­ment (Arti­cle 18). It must estab­lish con­trols so that every­one involved in the pro­cess­ing keeps the infor­ma­tion con­fi­den­tial, even after the rela­tion­ship ends (Arti­cle 20). And if a breach occurs that sig­nif­i­cantly affects the eco­nomic or moral rights of data sub­jects, it must inform them imme­di­ately (Arti­cle 19).

What the law no longer details. The 2025 law is brief on pro­ces­sors. It does not itself set the con­tent of the con­tract with the provider or a dead­line for the provider to notify the con­troller of an inci­dent. The con­troller’s obli­ga­tions remain intact and must be built through the con­tract, because the only way to comply with Arti­cles 18, 19, and 20 with infor­ma­tion hosted by a third party is for that third party to under­take the same obli­ga­tions. Accord­ingly, the clauses described below are con­trac­tual best prac­tice derived from those obli­ga­tions, not lit­eral require­ments of the law.

When the provider stops being a pro­ces­sor. The provider is a pro­ces­sor as long as it pro­cesses the data on your com­pany’s behalf. If it uses the data for its own pur­poses, such as com­pil­ing com­mer­cial sta­tis­tics or train­ing models, that com­mu­ni­ca­tion may stop being a pro­cess­ing engage­ment and become a trans­fer. In that case, your com­pany must pro­vide the recip­i­ent with the pri­vacy notice and the pur­poses, and the recip­i­ent assumes the con­troller’s obli­ga­tions (Arti­cle 35). Trans­fer­ring data out­side the per­mit­ted cases, or with­out any express con­sent that is required, are infrac­tions of the high­est cat­e­gory (Arti­cle 58, sec­tions XII and XIII).

Com­pen­sa­tion reaches both. Data sub­jects who suffer harm due to a breach of the law by the con­troller or the pro­ces­sor may claim the appli­ca­ble com­pen­sa­tion (Arti­cle 53).

What to do and by when

  1. Clas­sify your cloud providers by the type of data they host, and pri­or­i­tize those that process sen­si­tive, finan­cial, or cus­tomer data.
  2. Verify that each con­tract requires the provider to process the data only in accor­dance with your instruc­tions and for the pur­poses stated in the pri­vacy notice.
  3. Require secu­rity mea­sures equiv­a­lent to or stronger than your own, with the right to request evi­dence, inde­pen­dent audit reports, or cer­ti­fi­ca­tions.
  4. Agree on a fixed dead­line, mea­sured in hours, for the provider to notify you of any inci­dent, so that you can inform data sub­jects imme­di­ately.
  5. Reg­u­late sub­con­tract­ing: a list of sub­con­trac­tors, prior notice of changes, and the right to object to them.
  6. Expressly pro­hibit the provider from using the data for its own pur­poses, includ­ing model train­ing, unless autho­rized by you and, where appli­ca­ble, by the data sub­ject.
  7. Define the exit: return of the data in a usable format, a tran­si­tion period, and a cer­tifi­cate of dele­tion upon ter­mi­na­tion.
  8. Keep the con­tract and the evi­dence of com­pli­ance for at least ten years, as required by Arti­cle 49 of the Com­mer­cial Code (Código de Com­er­cio).

Recommendations to mitigate risk

The author­ity in this area, the Min­istry of Anti-Cor­rup­tion and Good Gov­er­nance (Sec­re­taría Anti­cor­rup­ción y Buen Gob­ierno), sanc­tions the con­troller. Breach­ing the secu­rity of data­bases, pro­grams, or equip­ment, when attrib­ut­able to the con­troller, and fail­ing to comply with the duty of con­fi­den­tial­ity are pun­ish­able by a fine of 200 to 320,000 times the Unit of Mea­sure­ment and Update (UMA), that is, MXN 23,462 to MXN 37,539,200, under Arti­cles 58, sec­tions VIII and XI, and 59, sec­tion III. If sen­si­tive data are involved, the penal­ties may be increased up to twofold (Arti­cle 59, sec­tion IV). In set­ting the fine, the author­ity con­sid­ers the nature of the data, whether the con­duct was inten­tional, the con­troller’s eco­nomic capac­ity, and recidi­vism (Arti­cle 60). With­out an ade­quate con­tract, your com­pany pays that penalty and has no clear avenue to seek recov­ery from the provider.

Self-assessment

Answer yes or no about your own com­pany.

  1. Have you iden­ti­fied the cloud providers that host per­sonal data of cus­tomers or employ­ees?
  2. Does each con­tract require the provider to process the data only in accor­dance with your instruc­tions?
  3. Does the con­tract set a fixed dead­line for the provider to notify you of an inci­dent?
  4. Can you request evi­dence of the provider’s secu­rity mea­sures?
  5. Do you know which sub­con­trac­tors your provider uses, and can you object to changes?
  6. Has it been agreed how you recover your data and how it is deleted when the con­tract ends?
  7. Does the con­tract pro­hibit the provider from using your data for its own pur­poses?

How we approach it at LEXURE

We review con­tracts with crit­i­cal providers against the obli­ga­tions the law imposes on your com­pany as con­troller, and we nego­ti­ate the sched­ules on pro­cess­ing, secu­rity, inci­dents, and exit. When the provider only offers stan­dard terms, we doc­u­ment inter­nal com­pen­sat­ing mea­sures so that the com­pany can show the author­ity that it acted with due dili­gence.

If your crit­i­cal infor­ma­tion lives on third-party ser­vices, sched­ule a diag­nos­tic meet­ing with us and let us review how well pro­tected your com­pany is.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), DOF March 20, 2025, last amended DOF November 14, 2025, Articles 2, sections XII and XX, 18, 19, 20, 35, 53, 58, sections VIII, XI, XII, and XIII, 59, and 60. Current text (opens in a new tab)
  2. Commercial Code (Código de Comercio), Article 49. Current text (opens in a new tab)
  3. Value of the Unit of Measurement and Update 2026, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes