October 1st, 2026
In Mexico, legitimate interest does not yet operate as a standalone legal basis for processing personal data held by private parties. Under current legislation, consent remains the general rule, except for the exceptions expressly set out in the Federal Law on the Protection of Personal Data Held by Private Parties. However, the institutional and legislative changes announced by the Secretaría Anticorrupción y Buen Gobierno open an opportunity to modernize the conversation: moving from a model focused almost exclusively on obtaining consent, to one that allows certain reasonable, necessary and proportionate processing to be justified under clear rules. For this to happen, the concept would need to be expressly recognized through a legal reform or corresponding regulatory development, with a scope and conditions that provide certainty to both companies and data subjects.
The discussion should not be framed as authorization to process data «without oversight,» nor as an additional burden for companies. Its value would lie in providing a clearer basis for certain types of processing that are already ordinary and necessary to the operations of many organizations — for example, security, fraud prevention, service improvement, internal compliance, cybersecurity or the administration of a legal relationship — and that do not always find an adequate answer in broad, generic or poorly informed consent. In those cases, legitimate interest could offer legal certainty, provided there is a reasonable justification linking the purpose pursued, the necessity of the processing and the data subject’s expectations.
The European reference point can be useful. The General Data Protection Regulation recognizes legitimate interest as a legal basis, but not as automatic authorization: it requires identifying the interest, demonstrating the necessity of the processing and weighing it against the rights and freedoms of the data subject. For Mexico, this would not mean mechanically importing the European model, but rather drawing on a concept that could provide greater regulatory flexibility, reduce reliance on formal consents that often fail to reflect a real decision, and bring the Mexican regime closer to international standards relevant to cross-border data flows.
If well designed, legitimate interest could also be positive for responsible innovation. In data-intensive sectors — including digital services, fintech, e-commerce, advertising, cybersecurity and artificial intelligence — there are processing activities that help prevent fraud, protect networks and systems, detect incidents, improve products or manage operational risk. The key would be having a legal basis that allows companies to operate with greater clarity and confidence, without losing sight of individuals’ rights or the need to adopt safeguards proportional to the context and risk of the processing.
The challenge will be finding a balance: preventing legitimate interest from becoming an open license to process personal data without consent, while also avoiding regulation so rigid that it loses practical usefulness. Reasonable regulation would need to make clear that legitimate interest does not replace consent when consent is required, that it must not be used to legitimize invasive or disproportionate processing, and that it requires special care regarding sensitive data, children and adolescents, intensive profiling, automated decisions or higher-risk emerging technologies. In the meantime, companies can begin by identifying processing activities that currently rely on generic consent and assessing whether, in the future, they could find a more suitable basis under a legitimate interest framework. The opportunity lies in building trust: enabling responsible innovation, cybersecurity and artificial intelligence under rules that are clear, verifiable and centered on people.
Our Privacy and Data Protection team remains at your disposal for any questions or comments.
Sincerely,
Adolfo Athié
aathie@basham.com.mx
Renata Buerón
rbueron@basham.com.mx