Your business has security cameras. Mexican law says the footage is personal data.
On March 21, 2025, a new Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP) came into force, abrogating the 2010 law and extinguishing INAI. The regulator, supervisor and enforcer is now the Secretaría Anticorrupción y Buen Gobierno [1][5]. The shift matters because any recording where a person is identifiable is personal data — and therefore regulated [3][5].
In practice, that means four minimum obligations:
- Visible privacy notice at every entrance to the surveilled area: controller identity, purpose, and where to consult the full notice. A sign that just says “Area under surveillance” or “Smile, you’re on camera” does not comply [4].
- No audio capture without documented justification, because in Mexico recording private conversations without consent can constitute a federal crime [4].
- No cameras in restrooms, locker rooms, union areas, or designated rest areas, regardless of the security justification [3].
- Respond to ARCO rights requests within 20 business days — Access, Rectification, Cancellation or Opposition to processing [1][4].
And there is a fifth point most operators miss: if you use facial recognition, the law treats you as a sensitive-data processor. The fine doubles and you need express written consent [2][4]. Penalties run from 100 to 160,000 UMA (MX $10,700 to MX $17.1M at 2026 value), and double for sensitive data [4].
( the law does not set a mandatory retention period, but it does require a documented one — 30 to 90 days is the common practice )
P.D. Does your video surveillance sign identify the data controller and where to consult the full privacy notice? If the answer is “no” or “I’m not sure”, today is a good day to fix it before the complaint arrives.
📰 Source: LFPDPPP 2025 (DOF 21-Mar-2025) + INAI Biometric Data Guide 2018 + INFO NL Video Surveillance Guide + editorial analysis by Jedi, September 2026.
This content is informational and does not constitute legal advice. For specific compliance, consult a lawyer or the Secretaría Anticorrupción y Buen Gobierno.
How this compares across jurisdictions
LFPDPPP does not operate in a vacuum. If your team stores Mexican employee footage in a global cloud, or has a parent company in another country, this 4-jurisdiction matrix tells you what stacks up:
| Jurisdiction | Applicable law | Max. footage retention (general) | Biometric consent required | Maximum penalty |
|---|---|---|---|---|
| 🇲🇽 Mexico | LFPDPPP + Reglamento | 30 days (recommended, no hard legal basis) | Yes — express privacy notice | ~$32M MXN + moral damages |
| 🇧🇷 Brazil | LGPD | Justified and proportionate (no hard deadline) | Yes — specific consent for biometrics | 2% revenue or R$50M per incident |
| 🇪🇺 EU (Schengen/EEA) | GDPR + LED 680/2019 | Necessary for purpose (≤72h for LPR in some cases) | Yes — specific legal basis (consent or public interest) | €20M or 4% global revenue |
| 🇺🇸 California (USA) | CCPA/CPRA | Necessary for stated purpose | Yes — opt-out + notice at collection | $7,500 per intentional incident |
📌 Operational reading: if you operate in more than one of these jurisdictions, the strictest rule wins. In practice, that is almost always the EU column (GDPR) or Mexico (LFPDPPP when biometrics are involved). Your CCTV RFP must ask the vendor: “What is your default retention policy, and can it be configured per camera?”
Sources
[1] Cámara de Diputados — Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, 2025) — https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf [2] INAI — Guía para el Tratamiento de Datos Biométricos (March 2018) — https://inicio.inai.org.mx/DocumentosdeInteres/GuiaDatosBiometricos_Web_Links.pdf [3] INFO NL — Guía de Videovigilancia (Nuevo León State Transparency Institute) — https://infonl.mx/descargas/GUIA%20DE%20VIDEOVIGILANCIA.pdf [4] MercadoSeguridad.mx — Cámaras de Seguridad y la Ley LFPDPPP: Guía para Negocios (updated August 2026) — https://www.mercadoseguridad.mx/blog/camaras-seguridad-privacidad-lfpdppp [5] Dossier de Prensa — Videovigilancia: ¿Qué sí se vale y qué no?, el INAI te explica (workshop with Commissioner Josefina Román Vergara) — https://www.dossierdeprensa.mx/videovigilancia-que-si-se-vale-y-que-no-el-inai-te-explica/