Ley Federal de Protección de Datos Personales en Posesión de los Particulares, ARCO rights

Article 21 lets any data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection), none conditioning or blocking the others, and requires personal data to be safeguarded so these rights can be exercised without delay. Article 22 gives a right of access to the data subject's personal data and to the conditions of its processing through the privacy notice.

Article 23 gives a right to rectify or correct inaccurate, incomplete, or outdated personal data. Article 24 gives a right to cancel personal data from the responsable's files, records, and systems at any time, subject to a blocking period equal to the statute of limitations for the underlying legal relationship before the data is finally suppressed, with notice to the data subject once cancelled and to any third party the data were transferred to before the cancellation.

Article 25 lists the grounds on which the responsable need not cancel data (a contractual necessity, a legal requirement, an obstacle to judicial or administrative proceedings, the data subject's own protected interests, the public interest, a legal obligation of the data subject, or a health professional's care under a duty of secrecy).

Article 26 gives a right to object to processing for a legitimate cause, including an unqualified right at article 26, fracción II to object to a fully automated decision that produces undesired legal effects or significantly affects the data subject's interests, rights, or freedoms, and that is intended to evaluate, without human intervention, their professional performance, economic situation, health status, sexual preferences, reliability, or behaviour; objection does not lie where processing is necessary to comply with a legal obligation imposed on the responsable.

Articles 27 to 30 set the request's required content and require the responsable to designate a person or department to handle it. Article 31 requires the responsable to communicate its determination within a maximum of twenty days of receiving an ARCO request, to give effect to a favourable determination within fifteen days of that communication, and lets both periods be extended once for an equal period on justified grounds.

Article 33 lists the grounds on which an ARCO request may be denied (inadequate identification, the data not being in the responsable's possession, a third party's rights, a legal impediment or an authority's ruling, or a request already carried out), each requiring written reasons.

Article 34 makes exercising ARCO rights free, limited to reproduction, copying, or shipping costs, and caps a repeat request within twelve months at three times the Unidad de Medida y Actualización absent a substantial change to the privacy notice.