Mexico private-sector data protection law, Article 11: a purpose not in the privacy notice needs the person's consent again (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, text in force with the last reform DOF 14-11-2025), Arts. 2(IV) and 11)
In Spanish. Article 2(IV) defines consent as a free, specific and informed expression of the person's will. Article 11 says processing must stay within the purposes in the privacy notice, and if the controller wants to process the data for a different purpose it must obtain the person's consent again. Licensing customer or staff records to a third party for AI training is a purpose no existing notice names, so fresh consent is needed unless the data is first dissociated (see the Article 9 entry). Text read on the Chamber of Deputies' consolidated version; the Official Gazette (dof.gob.mx) did not answer from here.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
“Manifestación de la voluntad libre, específica e informada de la persona titular de los datos mediante la cual se efectúa el tratamiento de los mismos ... El tratamiento de datos personales deberá limitarse al cumplimiento de las finalidades previstas en el aviso de privacidad, sin embargo, si el responsable pretende tratar los datos para una finalidad distinta a las establecidas en el aviso de privacidad, se requerirá obtener nuevamente el consentimiento de la persona titular.”
- Mexico private-sector data protection law, Articles 7 and 8: tacit consent is the general rule, sensitive and financial data need express consent (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 7 and 8)
- Mexico private-sector data protection law, Articles 2(XX), 35 and 36: transfers, inside or outside Mexico, go with the privacy notice and the recipient takes on the same duties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 2(XX), 35 and 36)
- Mexico private-sector data protection law, Articles 2 and 9: dissociated data needs no consent (Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 March 2025, last reform DOF 14-11-2025), Arts. 2(V), 2(IX) and 9(III))
It is shown on its own, not counted into a figure.
Cited in these 2 guides