Claude and the LFPDPPP: what companies in Mexico need to know

If your company already uses, or is about to connect, Claude to processes that touch customer, employee, or supplier data, the data-privacy question is not optional. And in Mexico, the answer to that question changed recently.

What changed in 2025

A new Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) took effect on March 20, 2025, fully replacing the 2010 law. The most visible change for any company: INAI (the National Institute of Transparency, Access to Information and Protection of Personal Data) stopped existing as an authority, as part of a December 2024 constitutional reform that eliminated several autonomous bodies. Oversight and enforcement over personal data held by companies moved to the Secretaria Anticorrupcion y Buen Gobierno (the Anti-Corruption and Good Government Ministry).

If your company's privacy notice still names INAI as the authority for complaints, it is out of date. This is not a cosmetic detail - it is the first thing any compliance review should fix.

What stayed the same

The LFPDPPP still requires a privacy notice for any company that processes personal data in Mexico, and people still keep their rights to access, rectify, cancel, and object to the use of their data (known as ARCO rights). The general rule is still tacit consent for ordinary data processing, unless the law requires express consent - for example, for sensitive personal data.

Where Claude fits into this

None of this is specific to artificial intelligence - it applies to any system that touches personal data. But when a company connects Claude to real processes (customer support, contracts, HR), it is worth asking exactly what data the model will see, for what purpose, and whether your privacy notice already covers that use.

One point that often causes confusion: under Anthropic's published commercial terms, Anthropic does not train its models on customer content (inputs or outputs) when you use commercial products such as the API, Claude Team, or Claude Enterprise. That does not replace your own obligation to notify people or to have a legal basis for processing their data - it is a separate point, about how Anthropic itself handles that information inside its service.

What to check before connecting personal data to Claude

• Map what data Claude will actually touch (customers, employees, suppliers) before connecting any process.
• Update your privacy notice if it still mentions INAI or does not reflect the current authority.
• Keep sensitive personal data out of processes where it is not actually needed for the use case.
• Assign a clear owner inside your company for these decisions - do not treat it as a purely technical question.

This is not legal advice

This page explains the general picture - it does not replace a legal review of your specific situation. The practical recommendation is to review your privacy notice and your data processes with your legal team before scaling Claude usage that touches personal data.

Where a certified partner fits in

As a Certified partner in the Claude Partner Network, we help map what data Claude would touch inside a specific process and define the use case with that context from the start. The legal work - your privacy notice and your lawful basis for processing - remains your legal team's responsibility.