Risk bulletin

Security breach: immediate notice to data subjects and the 72-hour myth

Mexican law does not grant 72 hours or require notice to the authority. It requires informing affected data subjects immediately, and that takes preparation.

LEXURE Cybersecurity Law Practice Team 4 min read Regulatory status verified in 2026

After an inci­dent, many teams repeat that there are 72 hours to notify. That dead­line exists, but it comes from the Euro­pean data pro­tec­tion reg­u­la­tion and applies to notice given to the Euro­pean author­ity. In Mexico the rule is dif­fer­ent, and on one point it asks for more: notice to data sub­jects must be given imme­di­ately.

What the law requires

Under Arti­cle 19 of the Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares), when a secu­rity breach, occur­ring at any stage of the pro­cess­ing, sig­nif­i­cantly affects the eco­nomic or moral rights of data sub­jects, the con­troller must inform them imme­di­ately so they can take steps to defend their rights.

Three con­se­quences follow from the text. The first is that there is no dead­line in hours: the stan­dard is imme­di­ate. The second is that the notice is addressed to the data sub­ject; nei­ther the law nor its reg­u­la­tions estab­lish manda­tory notice to the Min­istry of Anti-Cor­rup­tion and Good Gov­er­nance (Sec­re­taría Anti­cor­rup­ción y Buen Gob­ierno). The third is that the duty is trig­gered when the impact is sig­nif­i­cant, so the com­pany must assess it quickly and doc­u­ment why it con­cluded that it was or was not.

The 2011 Reg­u­la­tions, whose force along­side the 2025 law is debat­able, set out the min­i­mum con­tent of the notice: the nature of the inci­dent, the data com­pro­mised, rec­om­men­da­tions to the data sub­ject, imme­di­ate cor­rec­tive actions and the means to obtain more infor­ma­tion (Arti­cle 65 of the Reg­u­la­tions). Although their bind­ing force is open to debate, fol­low­ing them as a guide is pru­dent.

The 72 hours may indeed apply to your com­pany if it is sub­ject to the Euro­pean reg­u­la­tion because it offers ser­vices to people in the Euro­pean Union, or if a con­tract with a cus­tomer imposes them. In that case they apply as an obli­ga­tion in addi­tion to the Mex­i­can rule.

What to do and by when

  1. Define today who decides whether a breach is sig­nif­i­cant and under what cri­te­ria.
  2. Pre­pare notice tem­plates for data sub­jects with the min­i­mum con­tent, ready to be adjusted within hours.
  3. Keep data sub­jects’ con­tact details up to date so you can notify them through the fastest chan­nel.
  4. Review your con­tracts with cus­tomers and ven­dors to iden­tify agreed noti­fi­ca­tion dead­lines.
  5. Doc­u­ment every inci­dent, even if you con­clude it was not sig­nif­i­cant, with the date, the data affected and the rea­sons for your deci­sion.

Recommendations to mitigate risk

If the breach is attrib­ut­able to the con­troller, the fine ranges from 200 to 320,000 times the Unit of Mea­sure­ment and Update (UMA), equiv­a­lent to MXN 23,462 to MXN 37,539,200, under Arti­cle 58, sec­tion XI, and Arti­cle 59, sec­tion III. Fail­ing to give timely notice wors­ens the com­pany’s posi­tion and exposes it to claims from data sub­jects for dam­ages that could have been avoided (Arti­cle 53). If the author­ity opens a ver­i­fi­ca­tion pro­ceed­ing, the first thing it will ask for is the inci­dent log.

How we approach it at LEXURE

We pre­pare the assess­ment and notice pro­ce­dure, the tem­plates and the matrix of con­trac­tual noti­fi­ca­tion obli­ga­tions, so the com­pany can act within hours.

If your com­pany has not defined who decides and who gives notice in the event of an inci­dent, sched­ule a diag­nos­tic meet­ing with us.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Law on the Protection of Personal Data Held by Private Parties, Articles 19, 53, 58, section XI, and 59, section III. Current text (opens in a new tab)
  2. Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties (Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares), Articles 63 to 66. Published text (opens in a new tab)
  3. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes