Mexico private-sector data protection law, Articles 2 and 9: dissociated data needs no consent (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 2(V), 2(IX) and 9(III))
In Spanish. Personal data is any information about an identified or identifiable person, identifiable if identity can be determined directly or indirectly through any information. 'Disociación' (dissociation) is a procedure after which the data cannot be associated with the person nor, by its structure, content or degree of disaggregation, permit identifying them. The controller needs no consent to process data that has gone through dissociation first, so a holder that dissociates its records before licensing them avoids the consent step. The law sets no technical test or certification for dissociation beyond that wording, and does not say whether the act of dissociating is itself a processing that needs a basis (it is processing under Article 2(XIX); Article 9(III) covers the case 'prior' dissociation).
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
“Cualquier información concerniente a una persona identificada o identificable. Se considera que una persona es identificable cuando su identidad pueda determinarse directa o indirectamente a través de cualquier información ... Procedimiento mediante el cual los datos personales no pueden asociarse a la persona titular ni permitir, por su estructura, contenido o grado de desagregación, la identificación de la misma ... El responsable no estará obligado a recabar el consentimiento de la persona titular para el tratamiento de los datos personales cuando: ... Los datos personales se sometan a un procedimiento previo de disociación”
- Mexico private-sector data protection law, Article 11: a purpose not in the privacy notice needs the person's consent again (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, text in force with the last reform DOF 14-11-2025), Arts. 2(IV) and 11)
- Mexico private-sector data protection law, Articles 7 and 8: tacit consent is the general rule, sensitive and financial data need express consent (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 7 and 8)
- Mexico private-sector data protection law, Articles 2(XX), 35 and 36: transfers, inside or outside Mexico, go with the privacy notice and the recipient takes on the same duties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 2(XX), 35 and 36)
It is shown on its own, not counted into a figure.
Cited in these 2 guides