November 11, 2026
Mexico’s new regulatory framework for digital and electronic payments, (Diario Oficial de la Federación || Bienvenido al Sistema de Información del Diario Oficial de la Federación) effective as of November 5, 2026 seeks to promote the broader adoption of these payment methods and advance the digitalization of certain processes associated with their contracting and operation.
For businesses, these developments may have relevant implications from a personal data protection, information security, and technology vendor management perspective.
Although the regulation is primarily focused on payment methods, its implementation may result in new flows of personal information, increased reliance on technological infrastructure, and greater involvement of third parties in identification, authentication, and payment processes. Accordingly, organizations should also consider these developments in light of the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, or “LFPDPPP”), as well as their internal security and risk management frameworks.
Data Protection and Digital Identity
One relevant development is the incorporation of digital identification mechanisms, including the Digital CURP (CURP Digital) and, in certain circumstances, the possibility of using information available through the Digital Citizen File (Expediente Digital Ciudadano) to facilitate the contracting of financial services.
For organizations involved in these processes, the implementation of these mechanisms may entail new methods for collecting, accessing, exchanging, or validating personal data.
Accordingly, organizations should consider how these information flows fit within their existing privacy frameworks and, as appropriate, review matters such as:
- the purposes of processing and whether they are adequately reflected in applicable privacy notices;
- the personal data that is actually necessary for identification or contracting processes;
- internal access controls and data retention periods;
- exchanges of information with third parties; and
- the security measures applicable to the access, transmission, and storage of such information.
Rather than creating a separate data protection regime, the digitalization contemplated under the regulation may require organizations to reassess how their existing obligations under the LFPDPPP apply to these new processes and technologies.
Security and Continuity of Digital Services
The regulation also places importance on the availability and continuity of digital and electronic payment methods, including the need to address contingencies that may affect the relevant infrastructure, systems, services, or operations.
From a business perspective, this reinforces the importance of assessing whether systems involved in digital payments are appropriately incorporated into the organization’s information security, business continuity, disaster recovery, and incident response frameworks.
This assessment should cover both an organization’s own infrastructure and any technological dependencies whose disruption could affect the acceptance or processing of payments.
In addition, where a security incident involving these systems also affects personal data, organizations should assess in parallel the measures and obligations that may apply under Mexican data protection law.
Technology Vendor Management
The increasing digitalization of payments also makes third-party management particularly relevant.
Payment processors, cloud service providers, authentication platforms, digital identity providers, and other technology service providers may have access to personal information or manage components that are relevant to the availability and security of payment operations.
Organizations should therefore consider whether their vendor due diligence and contracting processes adequately address, as applicable:
- security standards and safeguards;
- the processing of and access to personal data;
- incident notification and management;
- service continuity and recovery;
- subcontracting and the involvement of additional third parties;
- data retention, return, and deletion; and
- responsibilities in the event of service disruptions or security incidents.
This assessment may be particularly relevant where an organization relies on a service provider to ensure the continuity and availability of a payment method.
What Should Organizations Consider Doing?
Practical implementation will depend on each organization’s business model, industry, and use of digital payment and identification mechanisms. Nevertheless, from a privacy and security perspective, organizations should consider the following actions:
- Map new data flows associated with digital payments and digital identification, identifying the relevant systems, service providers, and categories of personal data involved.
- Review privacy notices and internal processes to confirm that new processing activities are appropriately addressed under the LFPDPPP.
- Assess the security and resilience of payment infrastructure, including business continuity, recovery capabilities, and incident response procedures.
- Review technology vendors and relevant agreements, with particular attention to security, data processing, incident management, business continuity, and subcontracting arrangements.
- Monitor secondary regulations and their implementation, as these may further define the practical scope of certain requirements and clarify the industries or activities to which they apply.
Final Remarks
For businesses, the key privacy and security impact may not necessarily arise from the creation of new standalone obligations in these areas, but rather from the new processes, information flows, and technology dependencies that are likely to accompany the increasing digitalization of payments.
Against this background, a proactive approach may help organizations integrate these new mechanisms into their existing privacy, information security, business continuity, and third-party risk management programs by design, reducing the need for subsequent remediation or adjustments.
Our IT and Data Protection practice remains available to assess the implications of this regulation for your organization and to assist with any measures that may be appropriate from a data protection, information security, and vendor management perspective.
SINCERELY,
Adolfo Athie
Renata Bueron