Short-Form Privacy Notice Mexico (Aviso de Privacidad Simplificado)

The Short-Form Privacy Notice Mexico (Aviso de Privacidad Simplificado) is a concise data protection disclosure document required under Article 17 of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published in the Diario Oficial de la Federación on 5 July 2010 — Mexico's principal federal data privacy statute governing the collection, use, storage, and transfer of personal data by private-sector entities (particulares). The LFPDPPP is regulated by the Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Reglamento LFPDPPP), published in the DOF on 21 December 2011, and by the Lineamientos del Aviso de Privacidad issued by the Secretaría de Economía and the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) in 2013.

Mexican data privacy law recognizes three formats of privacy notice under Articles 15 through 17 LFPDPPP: (1) the aviso de privacidad completo (full notice), which contains all required elements in complete detail; (2) the aviso de privacidad simplificado (simplified notice), which contains the minimum required elements in condensed form and directs the data subject to the full notice for complete information; and (3) the aviso de privacidad corto (short notice), permitted when the medium of personal data collection does not allow the full simplified notice to be displayed — for example, voice data collection over phone, data collected via QR codes, or collection through physical spaces where the full notice cannot be posted. The Aviso de Privacidad Simplificado under Article 17 LFPDPPP is the most commonly used format for business-to-consumer and business-to-employee contexts.

Article 15 LFPDPPP establishes the minimum content that every privacy notice must contain regardless of format: the identity and domicile of the data controller (responsable), the personal data being collected and the purposes for which it will be processed, the mechanisms for exercising ARCO rights (access, rectification, cancellation, and objection — derechos de acceso, rectificación, cancelación y oposición), the options for limiting the use or disclosure of personal data (opciones para limitar uso o divulgación), the procedure for notifying changes to the privacy notice, and — where applicable — transfers of personal data to third parties (transferencias a terceros) and the purposes thereof.

The INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales), established under the Ley General de Transparencia y Acceso a la Información Pública, is the federal supervisory authority (autoridad reguladora) responsible for enforcing LFPDPPP compliance. The INAI may investigate data privacy complaints filed by affected individuals, initiate ex officio investigations, impose administrative sanctions (sanciones administrativas) under Articles 63 through 66 LFPDPPP, and refer cases involving criminal privacy violations to the Ministerio Público for prosecution under Articles 67 through 69 LFPDPPP and the applicable Código Penal Federal provisions.

The short-form privacy notice format is particularly important in Mexico because the LFPDPPP requires privacy notices to be made available at the point of data collection (al momento de la obtención de los datos) under Article 17, creating a practical requirement for concise, accessible disclosure that can be delivered in-person, on websites, in employment contracts, on intake forms, and in commercial transaction documents without overwhelming the data subject with legally dense text.

The Short-Form Privacy Notice Mexico is required in every context where a private entity (persona física or persona moral) collects, uses, stores, or transfers personal data belonging to another natural person (persona física), regardless of the medium of collection. Article 16 LFPDPPP establishes that the responsable must make the aviso de privacidad available prior to or at the moment of data collection — not after.

The aviso is needed by every business that collects customer data — names, contact information, purchase history, payment data, or behavioral data — through any channel: physical forms, websites, mobile applications, telephone calls, or in-person transactions. E-commerce platforms operating in Mexico are particularly exposed, as collecting payment information, shipping addresses, and browsing behavior without a compliant privacy notice constitutes a direct violation of the LFPDPPP.

The notice is required in all employment contexts: employers collecting worker personal data (RFC, CURP, NSS, bank account, medical records, biometrics, family information) for payroll, IMSS registration, or HR purposes must provide a privacy notice to workers at or before the start of employment, regardless of whether the employment contract already contains a data protection clause. The employment context triggers specific obligations regarding sensitive personal data (datos personales sensibles) under Article 9 LFPDPPP — health records, biometric data, and other sensitive categories require explicit consent (consentimiento expreso y por escrito).

The notice is needed by any professional services provider (lawyer, accountant, doctor, architect, consultant) who maintains client files containing personal data, as professional service providers are explicitly covered by the LFPDPPP as responsables. Professional service firms subject to regulatory oversight — financial institutions under the CNBV, insurance companies under the CNSF, and health providers — must comply with both the LFPDPPP and any sector-specific data protection regulations issued by their respective regulators.

The notice is required whenever personal data is transferred to third parties (terceros) inside or outside Mexico. International transfers (transferencias internacionales) to countries that do not have an adequate level of data protection under the INAI's criteria require additional safeguards — typically contractual clauses (cláusulas contractuales tipo) equivalent to Mexico's LFPDPPP standards or the data subject's express consent under Article 37 LFPDPPP.

A valid Short-Form Privacy Notice Mexico under LFPDPPP Article 17 and the Lineamientos del Aviso de Privacidad must contain the following minimum elements to be compliant with INAI standards and to provide a legally effective basis for personal data processing.

Identity and Domicile of the Data Controller (Responsable): Full legal name (razón social or nombre) and fiscal domicile (domicilio fiscal) of the entity or individual responsible for processing personal data. The domicilio is essential because it establishes the legal jurisdiction governing the notice and provides the data subject with a physical address for exercising ARCO rights. Legal entities must include their RFC and, if applicable, their corporate registration number (folio del Registro Público de Comercio). The identity disclosure requirement under Article 16 Fraction I LFPDPPP is non-negotiable — anonymous or pseudonymous data controllers are not permitted under the LFPDPPP framework.

Personal Data Collected and Processing Purposes: Description of the categories of personal data being collected (datos de identificación, datos de contacto, datos laborales, datos patrimoniales, datos de salud, datos biométricos, etc.) and the specific, explicit purposes (finalidades) for which each category will be processed. The Reglamento LFPDPPP Article 13 requires that purposes be described with sufficient specificity — vague statements like 'for marketing purposes' without further detail are considered insufficient under INAI enforcement practice. Sensitive personal data (datos personales sensibles under Article 3 Fraction VI LFPDPPP) must be explicitly identified, as their processing requires express written consent under Article 9 LFPDPPP.

ARCO Rights and Exercise Mechanism: A clear description of the ARCO rights available to the data subject — the right of Access (to obtain information about what personal data is held and for what purposes), Rectification (to correct inaccurate or incomplete data), Cancellation (to request deletion of data), and Objection (to object to specific uses of data) — and the mechanism for exercising them. The notice must specify the designated contact (departamento o persona encargada de datos personales), the physical or electronic address for ARCO requests, and the general timeframe for response. Under LFPDPPP Article 32, the responsable must respond to ARCO requests within 20 business days of receipt.

Transfers of Personal Data: Where the responsable shares, discloses, or transmits personal data to third parties (encargados — processors acting on behalf of the responsable, or terceros — independent recipients), the notice must identify the categories of recipients, the purposes of the transfers, and whether transfers are made to international recipients. Transfers within the same corporate group are treated as transfers to third parties under the LFPDPPP. Transfers for the primary purposes stated in the notice do not require separate consent if clearly disclosed in the notice, but transfers for secondary (secondary purposes — finalidades secundarias) require an opt-out opportunity under LFPDPPP Article 8.

Notice Change Procedure: The procedure by which the responsable will notify data subjects of material changes to the privacy notice — typically by posting the updated notice on the same website or medium where the original notice appeared, or by direct notification to data subjects via email or SMS where feasible. Under LFPDPPP Article 17, the responsable must keep the privacy notice updated and accessible.

Forms-legal.com provides this Short-Form Privacy Notice Mexico template as a practical starting point for LFPDPPP compliance. Every privacy notice should be reviewed by an abogado specializing in protección de datos personales to confirm alignment with the current INAI Lineamientos del Aviso de Privacidad, any sector-specific regulations, and the technical requirements for electronic privacy notices under the Lineamientos para el Tratamiento de Datos Personales en las Nuevas Tecnologías. The INAI's published resolutions (resoluciones de procedimientos de investigación y verificación) provide important guidance on how the authority interprets compliance standards in practice.