Mexico

Art. 25 provides that the existence of an integrity policy is weighed when determining a legal person's liability; the law does not make it a standalone duty. Its minimum elements are an organisation manual, a published code of conduct, control, monitoring and audit systems, internal and external reporting systems with disciplinary consequences, training, HR policies that avoid integrity risks and transparency of interests.

Processing generally needs consent (Art. 7; express for financial or asset data and written for sensitive data, Arts. 7-8), subject to exceptions in Art. 9. Controllers must give a privacy notice (Arts. 14-16) and handle access, rectification, cancellation and opposition requests (Arts. 21-34); Art. 31 sets a 20-working-day response period (Art. 2 fr. VIII defines days as working days).

Art. 19 requires breaches that significantly affect the data subject's patrimonial or moral rights to be reported to the data subject immediately; the text sets no hour or day limit and does not require notifying the Secretaría.

Art. 15, fr. IV requires financial entities to keep client identification information and documents, and those relating to reported acts, for at least ten years.

Art. 58, fr. I requires fintech institutions to establish documented measures and procedures to prevent and detect acts that could fall under Arts. 139 Quáter or 400 Bis of the Federal Criminal Code, and present them to the CNBV.

Art. 18, fr. VI requires persons carrying out vulnerable activities who suspect, or hold information indicating, possible illicit-proceeds offences to file a notice within 24 hours of learning of it, even if the act was not carried out. Art. 23 sets the 17th of the following month for ordinary notices.