Mexico private-sector data protection law, Articles 7 and 8: tacit consent is the general rule, sensitive and financial data need express consent (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 7 and 8)
In Spanish. All processing needs the person's consent unless the law makes an exception, and consent may be tacit: it is tacit when the privacy notice was made available and the person did not state a contrary will. Express consent is required where the law demands it, and for sensitive data (health, ethnic origin, beliefs and similar) it must be express and in writing. So for ordinary customer and staff records a clear notice of the new AI-licensing purpose with a way to object may be enough (my reading of the general rule in Articles 7 and 11 together); for sensitive data or financial data (Article 7 requires express consent for financial or asset data) it is not.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
“Todo tratamiento de datos personales estará sujeto al consentimiento de la persona titular, salvo las excepciones previstas por la presente Ley. ... El consentimiento será tácito cuando habiéndose puesto a disposición de la persona titular el aviso de privacidad, esta no manifieste su voluntad en sentido contrario. ... Tratándose de datos personales sensibles, el responsable deberá obtener el consentimiento expreso y por escrito de la persona titular para su tratamiento”
- Mexico private-sector data protection law, Article 11: a purpose not in the privacy notice needs the person's consent again (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, text in force with the last reform DOF 14-11-2025), Arts. 2(IV) and 11)
- Mexico private-sector data protection law, Articles 2(XX), 35 and 36: transfers, inside or outside Mexico, go with the privacy notice and the recipient takes on the same duties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 2(XX), 35 and 36)
- Mexico private-sector data protection law, Articles 2 and 9: dissociated data needs no consent (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 2(V), 2(IX) and 9(III))
It is shown on its own, not counted into a figure.
Cited in this guide