Ley Federal de Protección de Datos Personales en Posesión de los Particulares, transfer of personal data

LFPDPPP, arts. 35-36 (transfer of personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 21 March 2025.

A cross border transfer rule binding private bodies.

As of 19 September 2026.

What it requires

Before transferring personal data to a national or foreign third party, other than a persona encargada, communicate the privacy notice and the purposes of the processing to the recipient, and state in the notice whether the data subject accepts the transfer.
Do not transfer personal data without the data subject's consent unless a listed Article 36 ground applies, such as a legal or treaty basis, a transfer within a corporate group under common control, or a ground necessary to a contract or legal relationship with the data subject.
Bind the recipient of a transfer to the same data-protection duties that apply to you as the transferring responsable.

What it reaches

Obligation class

Transfer, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 35 conditions any transfer of personal data to a national or foreign third party, other than the persona encargada, on communicating the privacy notice and the purposes to which the data subject's processing is subject; the notice must state whether the data subject accepts the transfer, and the recipient assumes the same duties as the transferring responsable.

Article 36 lists the grounds on which a domestic or international transfer may proceed without the data subject's consent: a law or treaty to which Mexico is a party, medical prevention, diagnosis, care, or health-service management, a transfer within a corporate group under common control operating under the same internal processes and policies, a contract concluded or to be concluded in the data subject's interest, a public-interest or judicial-administration ground, the recognition, exercise, or defense of a right in a judicial proceeding, or the maintenance or performance of a legal relationship between the responsable and the data subject.

The chapter treats domestic and cross-border transfers under the same regime rather than imposing a separate data-localization or adequacy-list requirement for transfers leaving Mexico.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics

Read the law

Text of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares
official consolidated text on the Cámara de Diputados' LeyesBiblio

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app