Personal Data Use Authorization Mexico (Autorización de Uso de Datos Personales)

A Personal Data Use Authorization Mexico (Autorización de Uso de Datos Personales) is a formal written instrument through which a natural person (titular) grants explicit, informed, and freely given consent for a data controller (responsable) to collect, store, use, disclose, and otherwise process their personal data for one or more specified purposes. In Mexico, the primary legal framework governing personal data protection held by private parties is the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published in the Diario Oficial de la Federación on 5 July 2010. Articles 7 and 8 of the LFPDPPP establish the foundational principles of consent and the specific conditions under which personal data may be processed lawfully.

Article 7 of the LFPDPPP establishes seven data protection principles that all responsables must observe: licitud (lawfulness), consentimiento (consent), información (transparency), calidad (accuracy and relevance), finalidad (purpose limitation), lealtad (loyalty), proporcionalidad (proportionality), and responsabilidad (accountability). Article 8 specifies that the titular's consent must be obtained before any processing of personal data, unless one of the statutory exceptions applies — such as where data processing is required by law, for the performance of a contract to which the titular is party, or to protect vital interests. For datos personales sensibles (sensitive personal data) including health information, financial data, racial or ethnic origin, political opinions, religious beliefs, union membership, and biometric or genetic data, Article 9 of the LFPDPPP requires that consent be express (expreso) and written (por escrito), rather than tacit.

The Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published in the DOF on 21 December 2011, elaborates on the consent requirements established in Articles 7 and 8, specifying in Articles 43 through 48 the circumstances under which tacit consent is permissible and the procedures for revoking consent. The Lineamientos del Aviso de Privacidad, published in the DOF on 17 January 2013, establish the required content of all privacy notices (avisos de privacidad) that must accompany or precede any data collection in Mexico.

The regulatory and enforcement authority for personal data protection in Mexico's private sector is the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), a constitutionally autonomous body under Article 6 of the Constitución Política de los Estados Unidos Mexicanos. The INAI investigates complaints from data subjects, conducts compliance audits of responsables, and imposes administrative sanctions under Articles 63 through 65 of the LFPDPPP — ranging from warnings and fines of up to 320,000 days of general minimum wage for serious violations to criminal referrals for the illegal processing of sensitive personal data under Article 67 LFPDPPP.

The Ley Federal de Protección de Datos Personales en Posesión de Sujetos Obligados (LFPDPPSO), published in the DOF on 26 January 2017, governs data held by government entities (sujetos obligados) and follows analogous but distinct rules under the supervision of the INAI and state transparency institutes (institutos de transparencia estatales). A Personal Data Use Authorization executed under the LFPDPPP applies to private-sector data controllers and does not directly govern government data handling.

The digital economy context for data authorizations in Mexico is further shaped by the Ley Federal de Telecomunicaciones y Radiodifusión (LFTR), published in the DOF on 14 July 2014, and the Norma Oficial Mexicana NOM-151-SCFI-2016 governing electronic messages and digital records, which together establish requirements for electronic consent in e-commerce and telecommunications contexts. Online data collection platforms operating in Mexico must implement consent mechanisms that satisfy both the LFPDPPP and the LFTR's specific provisions on subscriber data and metadata protection.

A Personal Data Use Authorization Mexico is required whenever a private-sector organization, business, or individual acting as a data controller (responsable) intends to collect and process personal data from individuals in circumstances where statutory exceptions to the consent requirement do not apply. The LFPDPPP establishes consent as the default basis for lawful data processing, making the formal authorization document essential in a wide range of commercial and personal contexts.

The authorization is needed by businesses operating customer databases, marketing platforms, loyalty programs, or subscription services in Mexico that collect names, contact information, purchasing history, location data, or browsing behaviour. Article 8 of the LFPDPPP requires that consent be obtained before collection begins — retroactive consent is not recognized as valid under the Reglamento de la LFPDPPP. Direct marketing communications (including email, SMS, and telemarketing) targeting individuals in Mexico require explicit, documented consent, and the Lista de Exclusión Telefónica (REPEP registry managed by PROFECO) provides a further layer of consumer opt-out protection.

In the employment context, Mexican employers routinely use Personal Data Use Authorizations to document worker consent for HR data processing, payroll administration, biometric time-and-attendance systems, video surveillance (videovigilancia), and social media monitoring — all of which implicate personal data under the LFPDPPP. Where an employer processes datos personales sensibles such as health information for insurance purposes, disability accommodation, or IMSS compliance, the express written consent required under Article 9 LFPDPPP must be obtained and retained separately.

Healthcare providers, insurance companies, fintech platforms, educational institutions, and professional service firms operating in Mexico all require Personal Data Use Authorizations as a condition of their LFPDPPP compliance programs. Financial institutions regulated by the Comisión Nacional Bancaria y de Valores (CNBV) and insurance companies regulated by the Comisión Nacional de Seguros y Fianzas (CNSF) must comply with both the LFPDPPP and sector-specific data protection rules, making documented consent a dual regulatory requirement.

For cross-border data transfers — sending personal data from Mexico to a foreign recipient — Article 36 of the LFPDPPP requires that the data controller either obtain the titular's consent for the transfer, ensure the recipient country provides equivalent data protection, or use a contractual mechanism (such as a data transfer agreement) to bind the recipient to LFPDPPP-equivalent protections. A Personal Data Use Authorization that includes a cross-border transfer clause satisfies this requirement where the titular provides explicit advance consent for international transfers.

The INAI's published criteria for valid consent under the LFPDPPP require that the authorization be: (1) freely given without coercion; (2) specific to identified purposes; (3) informed — preceded by a complete aviso de privacidad; and (4) unambiguous — silence or inactivity does not constitute consent for sensitive data categories. Organizations that fail to obtain properly documented consent before processing personal data face INAI investigations that may result in public resolutions (resoluciones INAI), damage to commercial reputation, and administrative fines at the levels established in Article 64 LFPDPPP.

A valid Personal Data Use Authorization Mexico under the LFPDPPP and its Reglamento must contain the following essential elements to be legally effective and to satisfy INAI compliance standards.

Identification of Data Controller (Responsable): Full legal name, RFC (Registro Federal de Contribuyentes), domicilio fiscal (registered address), and contact details of the private party acting as data controller, together with the name and contact information of the designated data protection officer (Encargado de la función de datos personales) where applicable. Article 30 of the LFPDPPP requires that responsables designate a person or department responsible for data protection compliance.

Identification of Data Subject (Titular): Full name, official identity document number (INE/IFE, CURP, or passport), and contact information of the individual whose personal data will be processed. For sensitive categories under Article 9 LFPDPPP, the relationship between the titular and the responsable must also be described.

Categories of Personal Data to Be Processed: A specific, itemized list of the personal data to be collected and processed, distinguishing between ordinary personal data (datos personales) and sensitive personal data (datos personales sensibles) under Article 3 Fraction VI LFPDPPP. Sensitive data — including health information, financial records, biometric data, sexual orientation, religious beliefs, and political opinions — requires separate, express consent under Article 9.

Purpose of Processing (Finalidades): A clear statement of each specific purpose for which the personal data will be used, distinguishing between primary purposes (finalidades primarias, necessary for the relationship between the parties) and secondary purposes (finalidades secundarias, such as marketing or analytics) under the Lineamientos del Aviso de Privacidad. The titular must have the ability to consent to primary purposes and separately opt in or out of secondary purposes.

Data Transfers to Third Parties: Identification of any third parties (terceros) — including subsidiaries, service providers, government authorities, and foreign recipients — to whom the personal data may be transferred, the purposes of the transfer, and whether the recipient will act as a sub-processor (encargado) or an independent controller. For international transfers, the authorization must specify the destination country and the protective mechanism employed under Article 36 LFPDPPP.

Retention Period: The specific period for which the personal data will be retained and the criteria used to determine retention, in accordance with the principle of temporalidad under the Reglamento LFPDPPP Article 32. After the retention period, data must be deleted (supresión) or anonymized (anonimización) in accordance with the data controller's privacy policy.

ARCO Rights: A clear statement of the titular's rights of Acceso (access to their data), Rectificación (correction of inaccurate data), Cancelación (deletion of data no longer necessary), and Oposición (objection to processing for specified purposes), together with the procedure for exercising these rights — including the responsable's designated contact channel and the 20-business-day response period established by Article 32 LFPDPPP. The titular's right to file a complaint with the INAI (recurso de revisión ante el INAI) if the responsable denies or fails to respond to an ARCO request must also be stated.

Right to Revoke Consent: An explicit statement that the titular may revoke consent at any time for the processing of their personal data, along with the mechanism for revocation and any consequences of revocation (e.g., inability to continue providing a service that depends on the data in question), per Article 8 LFPDPPP and Article 44 of the Reglamento.

Signature and Date: The titular's autograph or electronic signature (firma electrónica avanzada valid under the Ley de Firma Electrónica Avanzada, published in the DOF on 11 January 2012) and the date of execution. For sensitive personal data, the signature must be handwritten or equivalent advanced electronic signature — clickwrap acceptance alone does not satisfy Article 9 LFPDPPP's express consent requirement for sensitive categories.

Forms-legal.com provides this Personal Data Use Authorization Mexico template as a starting point for compliance under the LFPDPPP. Every organization should have its data processing activities reviewed by an abogado especialista en protección de datos or a certified data protection professional (Oficial de Protección de Datos — OPD) to ensure the authorization aligns with the INAI's current interpretive criteria, the Reglamento de la LFPDPPP, the Lineamientos del Aviso de Privacidad, and any applicable sector-specific regulations issued by the CNBV, CNSF, COFEPRIS, or other Mexican regulatory bodies.