Cross-Border Data Transfer Agreement Mexico (Transferencia Internacional de Datos)

A Cross-Border Data Transfer Agreement Mexico (Acuerdo de Transferencia Internacional de Datos Personales) is a written contract between a Mexican data controller (responsable) and a foreign data recipient establishing the legal basis, security standards, and compliance obligations for transferring personal data (datos personales) from Mexico to a recipient located in another country. In Mexico, cross-border data transfers are governed primarily by the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published in the Diario Oficial de la Federación on 5 July 2010, and its Reglamento published on 21 December 2011, with Article 36 LFPDPPP establishing the general framework for international transfers (transferencias internacionales).

The LFPDPPP Article 36 provides that the transfer of personal data to recipients in foreign countries (países extranjeros) or to international or supranational bodies (organismos internacionales o supranacionales) requires that the transferee assume the same obligations as those applicable to the Mexican transferor — specifically, the data protection obligations established in the LFPDPPP and its Reglamento. Article 36 further requires that the foreign recipient be bound by an equivalent or higher level of data protection than that required by Mexican law. The Reglamento LFPDPPP Articles 68 through 74 detail the documentation, consent, and security requirements applicable to international transfers.

The Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), established under the Ley General de Transparencia y Acceso a la Información Pública (LGTAIP) and serving as the data protection authority (autoridad de protección de datos) for private sector entities under the LFPDPPP, has issued Guidelines (Lineamientos del Aviso de Privacidad) and Recommendations specifying the technical and organisational security measures required for international transfers. INAI Recommendation 03/2019 on security measures provides detailed technical requirements applicable to data transferred internationally.

Mexican data protection law under the LFPDPPP distinguishes between two types of cross-border data flows: (a) transferencia — where the data controller (responsable) transfers data to another data controller (responsable) who will use the data for its own purposes, requiring either the data subject's consent (consentimiento del titular) or a recognised legal exception under Article 37 LFPDPPP; and (b) remisión — where the data controller transfers data to a data processor (encargado) who processes data on behalf of and under the instructions of the Mexican data controller, governed by the encargo de datos framework under Article 50 LFPDPPP without requiring data subject consent. Cross-border data transfers subject to this agreement are primarily transferencias under Article 36.

The Norma Mexicana NMX-I-27001-NYCE-2015 (equivalent to ISO/IEC 27001:2013 Information Security Management Systems) is referenced by INAI as the benchmark security standard for data protection in Mexico. Compliance with this norm provides a recognised framework for the security obligations that a foreign data recipient must observe under the cross-border transfer agreement. The Reglamento LFPDPPP Article 71 specifically requires that the transferencia agreement document the security measures applicable to the transferred data.

From a commercial perspective, cross-border data transfers arise frequently in multinational business operations — cloud computing services hosted in the United States (AWS, Microsoft Azure, Google Cloud), shared HR systems for Mexican subsidiaries of foreign corporations, customer analytics platforms operated by US or European entities, cross-border e-commerce payment processing through platforms like PayPal, Stripe, or Mercado Pago, and outsourced call-centre or BPO services involving access to Mexican customer data. Each of these scenarios requires a legally compliant transfer mechanism documented through a written agreement under LFPDPPP art. 36 and INAI Lineamientos.

The Ley para Regular las Instituciones de Tecnología Financiera (Ley Fintech, DOF 9 March 2018) adds sector-specific data governance obligations for fintech companies (instituciones de tecnología financiera) regulated by the Comisión Nacional Bancaria y de Valores (CNBV) that share customer financial data with foreign payment processors or credit scoring platforms — these companies must comply with both LFPDPPP and Ley Fintech data transfer requirements in their cross-border data agreements.

A Cross-Border Data Transfer Agreement Mexico is required whenever a Mexican business or individual (the data controller / responsable under the LFPDPPP) transfers personal data of Mexican data subjects (titulares) to a recipient located outside Mexico — whether a corporate affiliate, service provider, or business partner — in compliance with LFPDPPP Article 36 and its Reglamento.

The agreement is required when a Mexican company engages a foreign cloud service provider to process Mexican customer or employee personal data. Under the LFPDPPP and INAI guidelines, using a US, European, or Latin American cloud platform to store or process personal data of Mexican residents constitutes an international data transfer requiring either consent or a compliant transfer mechanism. Companies using AWS (Amazon Web Services), Microsoft Azure, Google Cloud Platform, or Salesforce to process Mexican personal data must document the transfer basis.

The document is needed when a Mexican subsidiary transfers employee (empleado) or customer (cliente) personal data to its parent company or corporate headquarters abroad for payroll processing, HR management, performance reporting, or consolidated financial reporting purposes. Multinational groups with Mexican operations (filiales mexicanas) must document intra-group international transfers through binding corporate arrangements or individual transfer agreements under LFPDPPP art. 36.

The agreement is necessary when a Mexican data controller engages a foreign marketing analytics or data broker service to process customer behavioural data, purchase history, or contact information collected in Mexico. The LFPDPPP requires that the Mexican business inform data subjects in its aviso de privacidad (privacy notice) of international transfers and obtain consent unless a legal exception under Article 37 LFPDPPP applies.

Under LFPDPPP art. 36, Reglamento arts. 68–74, and INAI Lineamientos del Aviso de Privacidad, any Mexican business that transfers personal data internationally without a documented legal basis and a compliant transfer agreement exposes itself to INAI administrative sanctions ranging from $100 to $160 million MXN and reputational damage — making the cross-border transfer agreement a foundational compliance document for internationally active Mexican enterprises.

The agreement is also required when a Mexican fintech company regulated by the CNBV under the Ley Fintech shares customer financial data with foreign payment processors or credit scoring platforms, given the combined obligations of LFPDPPP and the Ley Fintech's data governance provisions.

For healthcare and telemedicine providers in Mexico regulated by the Secretaría de Salud and COFEPRIS (Comisión Federal para la Protección contra Riesgos Sanitarios), transferring patient health data internationally to foreign diagnostic platforms, telemedicine providers, or pharmaceutical research organisations requires not only LFPDPPP compliance but also adherence to the Norma Oficial Mexicana NOM-004-SSA3-2012 on clinical records — making the cross-border transfer agreement doubly important in the health data context.

A valid Cross-Border Data Transfer Agreement Mexico under the LFPDPPP, its Reglamento, and INAI guidelines must contain the following essential elements to provide a legally compliant basis for international data transfers:

Identification of Parties and Roles: Full legal name, RFC or foreign tax identification, registered address, and data protection contact (contacto de privacidad) of the Mexican data controller (responsable) and the foreign data recipient, with specification of whether the recipient acts as a data controller (responsable) in its own right or as a data processor (encargado) on behalf of the Mexican responsable. This distinction determines whether the transfer is a transferencia (Article 36 LFPDPPP) or a remisión (Article 50 LFPDPPP) and the applicable legal requirements.

Description of Personal Data Transferred: Itemised list of the categories of personal data (categorías de datos personales) being transferred — including ordinary personal data (nombre, RFC, CURP, dirección, correo electrónico, teléfono) and, where applicable, sensitive personal data (datos personales sensibles) under LFPDPPP Article 3 Fraction VI — financial information, health data, biometric data, religious beliefs, sexual orientation. Sensitive personal data transfers require explicit consent (consentimiento expreso) under Article 9 LFPDPPP and higher security standards.

Purpose and Legal Basis for Transfer: Specification of the specific, legitimate purpose (finalidad) for which the transferred data will be processed by the foreign recipient, and the legal basis for the transfer — either data subject consent (consentimiento), legal obligation (obligación legal), contract performance (ejecución de contrato), or other recognised exception under LFPDPPP Article 37. The purpose limitation principle under LFPDPPP Article 12 prohibits the foreign recipient from processing transferred data for purposes incompatible with the stated transfer purpose.

Security Obligations of Foreign Recipient: Detailed obligation for the foreign recipient to implement technical, administrative, and physical security measures (medidas de seguridad técnicas, administrativas y físicas) equivalent to those required under the LFPDPPP Reglamento and INAI recommendations — including data encryption at rest and in transit, access controls, audit logging, incident response procedures, and staff training. Reference to NMX-I-27001-NYCE (ISO 27001) provides the recognised standard.

Data Subject Rights Mechanism: Commitment by the foreign recipient to cooperate with the Mexican data controller in responding to ARCO rights requests (Acceso, Rectificación, Cancelación, Oposición — Access, Rectification, Cancellation, Opposition) within the timeframes required by LFPDPPP Articles 22 through 35 — 20 business days for access and rectification requests, 20 business days for cancellation and opposition. The foreign recipient must not obstruct the exercise of ARCO rights.

Data Breach Notification: Obligation for the foreign recipient to notify the Mexican data controller of any data security incident (incidente de seguridad) involving the transferred data within a defined timeframe (typically 24 to 72 hours), enabling the Mexican responsable to comply with INAI notification obligations under LFPDPPP Article 20 and Reglamento Article 40.

Return and Deletion of Data: Obligation to return or irreversibly delete transferred personal data upon termination of the transfer purpose or the agreement, with certification of deletion (constancia de borrado) provided to the Mexican data controller.

Forms-legal.com provides this Cross-Border Data Transfer Agreement Mexico template as a practical starting point. Complex cross-border transfers involving sensitive personal data, health records, financial data, or large-scale processing for multinational organisations should be reviewed by an abogado specialised in derecho de protección de datos and INAI compliance before execution.