Employee Data Protection Policy Mexico (Aviso de Privacidad para Empleados)

An Employee Data Protection Policy Mexico (Aviso de Privacidad para Empleados — also referred to as the Aviso de Privacidad RRHH or HR Privacy Notice) is a mandatory formal document through which an employer fulfills its obligation under Article 15 of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) published in the Diario Oficial de la Federación on 5 July 2010 to inform workers about the collection, use, disclosure, and retention of their personal data in the employment context. Article 15 LFPDPPP requires the data controller (responsable del tratamiento — in this context, the employer) to communicate to data subjects (titulares — the workers) the identity of the controller, the purposes for which personal data is processed, the data categories collected, recipients to whom data may be transferred, the worker's rights (ARCO rights: access, rectification, cancellation, and objection) and the procedure for exercising them, and whether the data is transferred to third parties.

The LFPDPPP classifies employment-related data in Mexico into two principal categories requiring different legal treatment. Ordinary personal data (datos personales) collected in the employment context — name, RFC (Registro Federal de Contribuyentes), CURP (Clave Única de Registro de Población), address, employment history, salary, bank account CLABE — may be processed on the basis of the contractual necessity arising from the employment relationship under Article 10 Section II LFPDPPP, without requiring explicit consent in most cases. Sensitive personal data (datos personales sensibles) — health information, biometric data (fingerprints, facial recognition data used in time-and-attendance systems), ethnic or racial origin, immigration status, disability, and sexual orientation — requires explicit written consent under Article 9 LFPDPPP before collection or processing.

Article 25 of the Ley Federal del Trabajo (LFT) reinforces the data protection framework in the employment context by requiring that employment documentation capture and maintain accurate worker identification data including RFC, CURP, and other personal identifiers — creating a legal basis for the processing of this data that is complementary to the LFPDPPP contractual necessity exception. The intersection of LFT Article 25 and LFPDPPP creates a dual compliance obligation: the employer must both collect the data required by the LFT for employment registration purposes and ensure that this collection is documented in an Aviso de Privacidad that meets LFPDPPP Article 15 requirements.

The Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), established as the autonomous data protection authority under the LFPDPPP and the Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados (LGPDPPSO) of 2017, enforces the LFPDPPP in the private sector employment context. INAI has published specific guidance (lineamientos y recomendaciones) for employment data processing, including the Guía para elaborar un Aviso de Privacidad, which provides templates and requirements for different categories of data subjects including employees. INAI may impose fines of up to 320,000 times the general minimum daily wage (Salario Mínimo General — approximately $89.2 million MXN at 2025 minimum wage levels) for serious LFPDPPP violations, and may require the employer to correct deficient privacy notices and notify affected workers.

The Aviso de Privacidad para Empleados must be delivered to each worker at or before the commencement of the employment relationship — delivery at the onboarding stage (Formulario de Incorporación) satisfies the LFT Article 25 timing requirement and the LFPDPPP Article 15 notification requirement simultaneously. The LFPDPPP requires the employer to be able to demonstrate that the notice was provided (carga probatoria del responsable) — making a signed acknowledgment (acuse de recibo) from each worker essential for compliance evidence. The Reglamento del LFPDPPP (published in the DOF on 21 December 2011) and the Lineamientos del Aviso de Privacidad (published in the DOF on 17 January 2013) provide detailed technical requirements for Avisos de Privacidad, distinguishing between the full notice (aviso de privacidad completo) and the simplified notice (aviso de privacidad simplificado) — the full notice is required when sensitive personal data is collected, which is invariably the case in employment contexts involving health, biometric, and financial data.

An Employee Data Protection Policy Mexico is required at the commencement of every employment relationship in Mexico — Article 15 of the LFPDPPP requires the Aviso de Privacidad to be provided to the worker before or at the moment personal data is first collected, which in practice means before or during the onboarding process and, ideally, before any recruitment-stage data collection.

The policy is needed when the employer collects biometric data from workers for time-and-attendance purposes — fingerprint scanners, facial recognition systems, or retinal scanners — since biometric data constitutes sensitive personal data under Article 3 Section VI LFPDPPP and requires explicit written consent under Article 9 LFPDPPP. INAI has specifically addressed biometric data in the employment context in its Criterios para el tratamiento de datos biométricos, requiring a dedicated privacy notice and a proportionality assessment demonstrating that biometric collection is necessary and cannot be replaced by less intrusive identification methods.

A revised or supplemental Aviso de Privacidad is needed whenever the employer introduces new data processing activities — for example, implementing a new HR information system (HRIS) that processes additional data categories, adopting an employee wellness or health monitoring program, introducing remote work monitoring tools that collect activity data under Articles 330-A through 330-K LFT, or sharing employee data with a new service provider or affiliated company (grupo empresarial) that was not disclosed in the original notice. Under Article 16 LFPDPPP, material changes to data processing activities require advance notice to the affected workers before the new processing begins.

The policy is needed when the employer is subject to an INAI investigation or complaint from a worker who alleges a data protection violation — the Aviso de Privacidad and the evidence of its delivery to workers are the primary documents the employer must present to INAI to demonstrate compliance. Employers who cannot produce a compliant Aviso de Privacidad during an INAI investigation are presumed to be in violation of Article 15 LFPDPPP and face immediate sanctions.

An updated Aviso de Privacidad is also required when significant regulatory changes occur — Mexico's data protection framework has evolved substantially since the LFPDPPP's 2010 enactment, with INAI issuing ongoing guidelines and criteria that refine compliance requirements. Employers should review their employee privacy notices at least annually and following major regulatory developments to ensure ongoing compliance with current INAI standards.

A valid Employee Data Protection Policy Mexico under LFPDPPP Article 15, the Reglamento del LFPDPPP, and the Lineamientos del Aviso de Privacidad must include the following mandatory elements to satisfy INAI compliance requirements.

Identity of the Data Controller (Responsable): Full legal name of the employing company, its RFC (Registro Federal de Contribuyentes), registered address (domicilio fiscal), and contact information for the data protection officer or designated privacy contact (nombre del responsable o encargado de privacidad, correo electrónico, teléfono). For corporate groups (grupos empresariales), the specific legal entity that acts as the data controller for each category of employee data must be identified — commonly the direct employer entity, not the holding company.

Personal Data Categories Collected: An itemized list of all personal data categories collected from workers during the employment relationship, organized by type: identification data (nombre, RFC, CURP, NSS, datos del INE/pasaporte, domicilio); payroll and fiscal data (salario, CLABE bancaria, SDI, régimen fiscal SAT); social security data (IMSS registration data, INFONAVIT subcuenta de vivienda, AFORE); health data (medical certificates, IMSS incapacidades, occupational health records, NOM-035 psychosocial assessments — classified as sensitive personal data requiring explicit consent); biometric data if collected (sensitive personal data requiring explicit consent); performance and disciplinary records; emergency contact and beneficiary data. Article 13 LFPDPPP requires that only the minimum personal data necessary for the stated purposes be collected (data minimization principle).

Purposes of Data Processing (Finalidades): Primary purposes (finalidades primarias — necessary for the employment relationship): IMSS registration and bimonthly quota calculation under Ley del Seguro Social Article 15; INFONAVIT housing fund contributions under Ley del INFONAVIT Article 29; ISR withholding and CFDI de nómina issuance under LISR Articles 94 and 96 and SAT regulations; STPS compliance documentation under LFT Articles 25, 153-A, and 423; NOM-035-STPS-2018 psychosocial risk management; HR administration, performance management, and training planning under LFT Article 153-A. Secondary purposes (finalidades secundarias — not necessary for the employment relationship, requiring separate consent): employee satisfaction surveys, participation in employer branding programs, use of worker photographs in company marketing materials.

Data Recipients and Transfers (Transferencias): Mandatory disclosures to government authorities — IMSS, INFONAVIT, SAT, STPS, INM (for foreign workers), CONSAR/AFORE; service providers acting as data processors (encargados) — payroll outsourcing companies (outsourcing de nómina), HR information systems providers, background check services, occupational health service providers — each of whom must be subject to a data processing agreement (contrato de encargo de tratamiento) under Article 50 LFPDPPP. International data transfers (transferencias internacionales) to affiliated companies or cloud service providers outside Mexico require additional safeguards under Articles 36 and 37 LFPDPPP.

ARCO Rights and Exercise Procedure: Under Articles 22 through 35 LFPDPPP, workers have the right to access their personal data (Acceso), correct inaccurate data (Rectificación), request deletion of data no longer necessary for the employment purposes (Cancelación — subject to legal retention obligations under Article 804 LFT), and object to specific processing activities (Oposición). The Aviso de Privacidad must specify the procedure for submitting ARCO rights requests — the designated contact (correo electrónico o área de RRHH), the required form (formulario de solicitud ARCO), the response timeframe (20 business days under Article 32 LFPDPPP), and the right to escalate to INAI if the employer fails to respond adequately. Forms-legal.com provides this Employee Data Protection Policy Mexico template to help employers fulfill their LFPDPPP Article 15 obligations in the employment context.

Data Retention Periods: Specification of how long each category of employee data is retained — employment records must be kept for at least one year after termination under Article 804 LFT; tax records must be retained for five years under the Código Fiscal de la Federación (CFF); IMSS records must be retained for five years under the Ley del Seguro Social. After expiration of mandatory retention periods, data must be deleted or anonymized under Article 11 LFPDPPP. Workers' ARCO cancellation rights are limited during mandatory legal retention periods.

Security Measures: A statement that the employer implements appropriate technical, administrative, and physical security measures under Article 19 LFPDPPP to protect employee data from unauthorized access, loss, alteration, or disclosure — referencing the specific measures implemented (encryption, access controls, confidentiality agreements with HR staff) without exposing security details that could compromise the measures.