Mexico LFPDPPP

Federal Law on Protection of Personal Data Held by Private Parties - data subject rights, ARCO, security measures.


Short name	LFPDPPP
Region	Americas
Country or scope	Mexico
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers LFPDPPP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for LFPDPPP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for LFPDPPP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MX-LFPDPPP-19` Security Measures	Controllers must establish and maintain administrative, technical and physical security measures protecting personal data against damage, loss or alteration; verifiable component integrity evidences such measures (LFPDPPP Art. 19)	Scan
`MX-LFPDPPP-20` Breach Assessment Readiness	Security breaches materially affecting data subjects must be reported to them; assessing a breach's scope requires knowing the exact versions of software handling the data (LFPDPPP Art. 20)	Scan
`MX-LFPDPPP-14` Accountability for Third-Party Processing	The controller remains responsible for compliance even when data is processed by third parties on its behalf, which requires knowing who supplies the software components in the processing chain (LFPDPPP Art. 14)	Scan
`MX-LFPDPPP-11` Data Quality Principle	Personal data must be kept accurate, complete and up to date for its purpose; the systems inventory itself must meet the same completeness bar, with components fully named and versioned (LFPDPPP Art. 11)	Scan
`MX-LFPDPPP-30` Personal Data Officer	Every controller must designate a person or department responsible for personal data, providing a reachable point of accountability for the systems described in the SBOM (LFPDPPP Art. 30)	Scan
`MX-LFPDPPP-36` Transfer Documentation	Domestic and international transfers must be documented and communicated via the privacy notice, presupposing identifiable, timestamped documentation of the processing environment (LFPDPPP Art. 36)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`LFPDPPP-Art6`	Consentimiento (Art. 6)
`LFPDPPP-Art13`	Derechos ARCO (Art. 13)
`LFPDPPP-Art16`	Aviso de Privacidad (Art. 16)
`LFPDPPP-Art19`	Medidas de Seguridad (Art. 19)
`LFPDPPP-Art34`	Transferencia de Datos (Art. 34)
`LFPDPPP-Reg57`	Responsabilidades de Seguridad: Reglamento Art. 57-59
`LFPDPPP-Art36`	Datos Sensibles
`LFPDPPP-BR-01`	Notificación de Vulneraciones
`LFPDPPP-DP-01`	Privacidad desde el Diseño
`LFPDPPP-RET-01`	Conservación y Supresión de Datos

Policy templates

Written for LFPDPPP:

Política de Seguridad de la Información: LFPDPPP
Procedimiento para el Ejercicio de Derechos ARCO

And 22 from the standard set, adapted to LFPDPPP.