Translation
Translated from the Spanish source, which is the normative text. Status: draft pending human review. Differences are resolved in the Spanish text.
Privacy in Mexico: profile proposal¶
Proposed; not accepted
This card prepares a specification of ASILO-R-006 for a limited case of processing by private-sector entities in Mexico. ASILO 0.1 and MILPA 0.1 remain in force. Assignment of a profile owner, competent legal review and methodological acceptance remain pending. This card does not establish an implementation's conformance.
Source consultation date: 15-Oct-2026. Profile status: proposed. The card gathers
questions and evidence for review; it is neither a publication-ready privacy notice nor an
opinion on a real case.
Purpose and first step¶
This proposal is for people preparing a project built with AI assistance that might process personal data in a private-sector context in Mexico. The first step is to identify who determines the processing, its purpose, operations, data categories, recipients and event date. Then check whether the case fits the scope. The jurisdictional profiles guide explains how to separate those dimensions.
| Aspect | Scope of this proposal |
|---|---|
| Related method | ASILO 0.1, mainly ASILO-R-006; provenance and separation of claims through MILPA 0.1. |
| Pilot case | Fictional private entity and adults; synthetic contact-data inventory for a limited purpose. |
| Jurisdiction considered | Mexico, initial review of a federal source; no assumption of full state, municipal or sector coverage. |
| Outside the pilot | Sensitive, financial or patrimonial data; public-sector entities, minors, regulated sectors and complex international transfers. These need specific analysis. |
| Profile owner | Pending a recorded human assignment. |
| Implementations evaluated | None in this card; no library, provider or engine is prescribed. |
Being outside the pilot means neither exemption from obligations nor permission to operate.
Speaking Spanish, choosing es-MX or using a Mexican cloud region does not settle applicability.
Fictional example¶
A fictional private library wants to review which fields it needs to handle a request. It works with a synthetic inventory of possible contact fields, without real personal records. It records that origin separately from the file's exposure classification. Its first output is a list of questions, possibly unnecessary fields and pending decisions; it publishes no notice and sends no data to an external service.
The example supports practicing the procedure. It does not establish that a particular legal basis, retention period or transfer is valid. If real data enter, the purpose changes or another recipient appears, review the context before reusing the previous conclusion.
Starting legal source¶
The current consolidated text from the Chamber of Deputies identifies the new Federal Law on Protection of Personal Data Held by Private Parties, published on 20-Mar-2025, and the latest amendment on 14-Nov-2025. The publication decree provides the original context. The consultation record is kept in jurisdiction sources.
This identification does not exhaust applicable sources. Pending review covers articles, exceptions, transitional provisions and related instruments. Numbering, an authority or a guide from the previous law is not automatically transferred to the current text. No universal retention period, processing basis or model notice is set here.
The November amendment changes procedural supplementation in Article 4; its transitional provisions distinguish the decree's entry into force from gradual application related to the CNPCF (National Code of Civil and Family Procedure). If a case needs that regime, checking the relevant declaration remains pending. The 2011 regulations are not adopted in full without reviewing compatibility and later provisions either.
Research and evidence matrix¶
The rows specify questions for ASILO-R-006. They are research proposals, with no new universal requirements. Each future conclusion will identify its article, context and review; the legal source and design decision will remain separate.
| Topic | Topic location in the text consulted | Proposed question and evidence |
|---|---|---|
| Applicability and actors | Articles 1, 2 and 13. | Identify subject, activity, roles and possible exclusions; facts and competent review. |
| Classification | Articles 2-VI, 8 and 12. | Identify data categories; separate synthetic origin from exposure and declare mappings between schemes. |
| Purpose and basis | Articles 5–7, 9 and 11–13. | Relate data, purpose and consent or a specific exception; retain basis and conditions. |
| Information for the person | Articles 14–17. | Research notice content, form and delivery; final text pending review. |
| Retention | Articles 10, 24 and 25. | Research retention, blocking and erasure by purpose and provision; no generic period. |
| Revocation, rights and deletion | Article 7 and Articles 21–34. | Document channel, identity/representation, owner and exceptions; test with synthetic data. |
| Security and incidents | Articles 18–20. | Relate risks, controls, confidentiality and breach assessment; communication conditions still to be reviewed. |
| Recipients and transfers | Article 2 and Articles 35–36. | Distinguish relationships, recipients and purposes; document flows and review of conditions. |
| Responsibility and evidence | Article 13, in relation to the preceding provisions. | Identify who maintains decisions, sources and controls; versions and test results. |
The articles are locators for reading the full context, not an exhaustive list of obligations or an applicability decision. If automated decisions are involved, review also considers Article 26-II. That case is outside this pilot's evaluation.
Inventories and documentation do not replace system controls. Credentials and keys retain the restrictions in ASILO-R-006. Critical effects and ambiguity retain the conditions in ASILO-R-005.
Outputs, review and open questions¶
The first dossier can produce an applicability record, a sourced matrix, a synthetic inventory, conflicts and pending decisions. “Undetermined” preserves uncertainty; it means neither absence of obligation nor authorization of the affected effect.
Before proposing acceptance of the profile, the following remain pending:
- Assign an owner and delimit the case with a person competent in the subject.
- Complete the map of articles, exceptions and transitional provisions, fixing the consulted content.
- Review specifications, exclusions and their relationship to the base requirement, without silently expanding it.
- Define evidence and evaluation cases for implementations seeking to cover it.
- Record the corresponding decision under governance.
Legal review of the case, methodological acceptance of the profile and authorization of an operation are different decisions. Future tests may cover a change of purpose, new recipient, outdated source, excluded scope and review of an object under a different context. No result is summarized as “compliant with Mexico” without scope and evidence.