Data Processing Agreement in Mexico: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract between a company that decides how personal data is used (the controller, often called the responsable in Mexico) and a supplier that processes that data on its behalf (the processor, or encargado). It sets out what the processor may do with the data, how it must protect it, and what happens when the relationship ends. In Mexico a DPA is usually signed alongside a main contract such as a SaaS, services or outsourcing agreement. This page is general information, not legal advice. Confirm the current position with a qualified Mexican lawyer before you sign. ## What law governs data processing in Mexico? Private-sector personal data is governed by the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares). A new version was published in the Official Gazette on 20 March 2025 and took effect the next day, replacing the 2010 law. The reform dissolved the data authority INAI and moved oversight to the Secretariat of Anti-Corruption and Good Governance (Secretaria Anticorrupcion y Buen Gobierno). It also tightened rules on objecting to processing, including processing by automated or AI-based means. The core concepts a DPA has to reflect: - Responsable and encargado. The controller (responsable) decides the purposes and means; the processor (encargado) processes only on documented instructions. The encargado relationship is the Mexican equivalent of a processor arrangement and is expressly recognised.

• Privacy notice (aviso de privacidad). The controller must give data subjects a privacy notice stating who collects the data, what for, and how to exercise rights. The processor must act consistently with it.
• ARCO rights. Individuals have rights of access, rectification, cancellation and objection (derechos ARCO). The processor has to help the controller answer these requests.
• Security. Controllers and processors must keep administrative, technical and physical security measures appropriate to the data, and report certain breaches.
• Transfers. Sharing data with a third party that uses it for its own purposes is a transfer and usually needs the data subject to have been informed and, for many cases, to consent. Passing data to an encargado that only processes on instructions is a remission, not a transfer, and is treated differently. ## Key clauses in a Mexican DPA - Roles and instructions. Identify the responsable and the encargado, and require processing only on the controller's documented instructions.
• Subject matter and scope. The nature, purpose and duration of processing; the categories of data and of data subjects.
• Security measures. Administrative, technical and physical safeguards appropriate to the data, consistent with the law's security principle.
• Confidentiality. A duty on everyone with access to keep the data confidential, during and after the engagement.
• Sub-processors. Whether the encargado may engage others, on what notice or approval, and flow-down of the same obligations.
• ARCO assistance. The processor must help the controller respond to access, rectification, cancellation and objection requests within legal timeframes.
• Breach handling. Prompt notice of security breaches so the controller can meet its own obligations.
• Audit and oversight. The controller's right to verify compliance.
• International transfers. Terms for any transfer abroad, aligned with the privacy notice and consent position.
• Return and deletion. On termination, return or securely delete the data and existing copies, subject to any legal retention.
• Liability and governing law. Allocation of responsibility and Mexican law. ## A simple Mexican DPA skeleton you can adapt 1. Parties, roles and definitions

2. Subject matter, nature, purpose and duration
3. Categories of personal data and data subjects
4. Processor obligations and documented instructions
5. Security measures
6. Confidentiality undertakings
7. Sub-processors
8. Assistance with ARCO rights and the privacy notice
9. Personal data breach notification
10. Audit and inspection
11. International transfers and remissions
12. Return and deletion on termination
13. Liability and indemnity
14. Governing law and dispute resolution
15. Annexes: processing details and security measures ## Common mistakes in Mexican DPAs - Copying an EU GDPR DPA unchanged. The Mexican law uses its own concepts (responsable, encargado, ARCO rights, remission versus transfer, the aviso de privacidad). A straight GDPR template misstates the roles and the obligations.

• Still naming INAI. Since the 2025 reform the authority is the Secretariat of Anti-Corruption and Good Governance. Old templates that reference INAI are out of date.
• No privacy notice alignment. The DPA must be consistent with the controller's aviso de privacidad; a mismatch undermines both.
• Confusing transfer with remission. Sending data to a processor that only acts on instructions is a remission; treating it as a transfer, or the reverse, leads to the wrong consent and notice steps.
• Vague security terms. The law expects concrete administrative, technical and physical measures, not a bare promise to be careful.
• No deletion plan. Failing to say how data is returned or destroyed at the end leaves the processor holding data it has no basis to keep. ## Keeping your data agreements under control The hard part of data processing agreements is not signing one. It is keeping every DPA aligned with your privacy notice, tracking which suppliers hold which categories of data, spotting a sub-processor or transfer clause that drifted from your standard, and updating terms when the law changes, as it did in 2025. When this lives in scattered files, it is easy to lose track of who processes what. That is the work an AI contract workspace can hold in one place: draft from your approved DPA template, see per-clause risk and compliance items flagged against how your company contracts, edit clauses in plain language, and keep a live timeline of versions and obligations across suppliers. Adira is one such workspace if you want to see the idea in practice. Its depth outside India is on the roadmap, so confirm Mexico-specific data points with local counsel. ## FAQ