Privacy notice for a therapy practice in Mexico: what the 2025 law requires

If you run a therapy practice in Mexico, open your aviso de privacidad — the privacy notice Mexican law obliges you to publish — and look for the number 9. If it says that article 9 of the federal data-protection law requires express written consent for sensitive data, it was drafted against a statute that ceased to exist on 21 March 2025. That rule now lives in article 8, and today’s article 9 says close to the opposite: it lists the situations in which consent is not required. Almost every template circulating fails it. What follows is documentation and practice management, not legal advice.

The thirty-second test: six articles shifted

The federal personal-data law in force was published in the Diario Oficial de la Federación on 20 March 2025 (last reformed 14 November 2025) and repealed the 2010 statute, which the Cámara de Diputados now archives stamped “Ley Abrogada DOF 20-03-2025”. The point is not that the law changed — everyone said that — but where: the six articles a privacy notice depends on each moved back one.

Subject	2010 law (repealed)	Law in force
General consent rule	art. 8	art. 7
Sensitive data: express and written	art. 9	art. 8
Duty to inform through the notice	art. 15	art. 14
Mandatory contents of the notice	art. 16	art. 15
How the notice is made available	art. 17	art. 16
Deadline to answer an ARCO request	art. 32	art. 31

The second error is more visible: any notice still naming INAI is factually wrong today. INAI was dissolved by the same reform, and since article 15, fraction V, requires the notice to describe real mechanisms for exercising rights, pointing clients at a body that no longer exists fails it.

Three documents, not one

This applies to you: the law binds every private “persona física o moral” — individual or legal entity — that processes personal data, with no size threshold (article 2, fraction XVI). And most templates fuse three instruments with different legal bases and failure modes.

The aviso de privacidad is a data-protection instrument (articles 14 to 16). Article 2, fraction I, defines it as a document made available to the titular — the person the data belong to — “a partir del momento en el cual se recaben sus datos personales”, from the moment the data are collected. It is informative: it discloses, it does not authorize, and in principle nobody signs it.

Express written consent for sensitive data is article 8, and this one does authorize. It carries a handwritten signature, an electronic signature, or an equivalent authentication mechanism. This is what makes it lawful for you to hold a clinical record; the notice does not.

Consent to therapy itself is the ethical and health-law instrument. Its Mexican basis is the general health law: the right to “decidir libremente sobre la aplicación de los procedimientos diagnósticos y terapéuticos ofrecidos” (article 51 Bis 2), after sufficient, clear, timely and truthful information (article 51 Bis 1). If you use the formal consent form defined by the clinical-record standard NOM-004, its clause 10.1.1 sets yet another minimum content — though outpatient psychotherapy is not on the list of events that require one (clause 10.1.2). The standard itself is covered in the guide to Mexico’s clinical-record standard.

The trap: many templates merge all three into one page the client signs on arrival. That is fragile: the notice must be available from the moment you collect data, signed or not, and the article 8 consent must be demonstrable.

What the notice must contain

Article 15 fixes the minimum: the responsable’s identity and address (fr. I); the data processed, “identificando aquéllos que son sensibles” (fr. II); the purposes, “distinguiendo aquéllas que requieren el consentimiento” (fr. III); the options offered for limiting use or disclosure (fr. IV); the mechanisms, means and procedures for exercising ARCO rights (fr. V); and how you will communicate changes to the notice (fr. VI). Fractions II and III are new relative to the repealed law, which only asked you to flag that sensitive data were involved. Article 7 adds that the mechanism for revoking consent must live in the notice; article 29 requires you to designate someone to handle rights requests.

Article 16 settles it, and the criterion is the collection channel, not length. Collected in person on printed forms, the notice must be given “en ese momento”, unless it was already provided earlier. Collected by any “medio electrónico, óptico, sonoro, visual, o a través de cualquier otra tecnología” — your booking form, WhatsApp, an intake questionnaire sent by email — it must be provided in modalidad simplificada: fractions I to IV plus a pointer to where the full notice can be read. Even that short form must identify which data are sensitive. Here is how fractions II and III read together:

“Sensitive data I process: your present and future mental-health status, including presenting problem, history, instrument results and session notes. Purpose requiring your express written consent: building and keeping your clinical record in order to provide psychological care and continuity of treatment.”

That is an illustration, not a template; your notice must describe your actual practice, in Spanish, with your own details.

Nearly everything a psychology practice records is sensitive data: article 2, fraction VI, includes anything revealing “estado de salud presente o futuro”. Article 8 then leaves no room — consent must be “expreso y por escrito […] a través de su firma autógrafa, firma electrónica, o cualquier mecanismo de autenticación”. If you record session audio or use a tool that processes it, that consent must be specific, documented and revocable, never a default; how to draft and document it is in the guide to informed consent in psychotherapy. The health-care exception in article 9, fraction VI, does not release you: it applies only while the person is unable to consent; a separate question is what the Mexican state can demand about your patients.

In July 2026 the Secretaría Anticorrupción y Buen Gobierno fined the Mexican Football Federation 42,849,095 pesos for two things: not stating in its privacy notice that the biometric data it collected were sensitive, and accepting a web checkbox “sin recabar firma autógrafa ni firma electrónica”. It is not a mental-health precedent, but it is the exact analogue of two shortcuts a small practice takes. Omitting any article 15 element is a named infraction (article 58, fraction V), which article 59, fraction II, punishes with a fine of 100 to 160,000 UMA — the 320,000 band belongs to the graver conducts in fractions VIII to XVIII. Fraction IV adds that where sensitive data are involved the penalties may be increased up to twofold. Other clinical documentation mistakes carry costs of their own.

ARCO rights and the deadlines

ARCO — acceso, rectificación, cancelación, oposición — are four independent rights (articles 22, 23, 24 and 26). A valid request needs a channel for notifications, proof of identity or representation, a clear description of the data (except for access) and the right being exercised (article 28). The deadlines are the most valuable numbers here, with a detail almost nobody states: article 2, fraction VIII, defines “Días: Días hábiles” — every deadline in the statute is in business days, which roughly doubles the wall-clock time.

Stage	Deadline	Article
Communicate your decision	20 business days from the request	art. 31
Make it effective, if granted	15 business days from your answer	art. 31
Extend either one	once, by an equal period, if circumstances justify it	art. 31
Client escalates to the Secretaría	15 business days from your answer, or from when your deadline lapsed	art. 40

Exercising these rights is free; only reproduction, copying and shipping costs may be recovered (article 34). You may refuse, but only on the five grounds in article 33, and always with reasons, in time, through the same channel. If your instincts come from the GDPR, reset them: this statute has no portability right, and the clock is 20 business days, not one month.

“Delete my record”

Article 25, fraction VII, excuses you from cancelling data processed “para la prevención o para el diagnóstico médico o la gestión de servicios de salud” by a health professional bound by a duty of secrecy; fraction II adds data that must be kept by legal mandate — where NOM-004’s five-year minimum from the last act of care comes in. Two cautions: the exception excuses cancellation, not an answer — article 33 still requires a reasoned, timely reply — and where it does apply, article 24 opens a blocking period before deletion. The right of access survives regardless, and it often surfaces after a contested termination.

Where a complaint goes now

Not to INAI, which no longer exists, and not to Transparencia para el Pueblo — that is the most common error today. It inherited INAI’s transparency and access-to-public-information functions and is a separate deconcentrated body; private-sector data protection stayed inside the Secretaría itself. The chain, as the header of its own private-sector complaint form has it, runs:

Secretaría Anticorrupción y Buen Gobierno → Subsecretaría de Buen Gobierno → Unidad de Protección de Datos Personales → Dirección General de Datos Personales en el Sector Privado.

Its powers are set out in articles 2 and 30-F of the Secretaría’s internal regulation.

One absence worth declaring: there is no reglamento

The statute repeatedly delegates detail to “el Reglamento” — compensatory measures in article 17, proof of identity in article 41 — and no such regulation has been issued under it. The 2011 one is still catalogued as in force because nothing repealed it: the repealing transitorio lists four laws and one acuerdo, none of them the regulation. But it implements the 2010 statute: orphaned, not repealed. That is why no reglamento is cited here — and why you should document how you verify the identity of whoever writes to you. One question it leaves unsettled: whether the statute reaches a practice based outside Mexico that sees Mexican clients. Article 1 binds “en todo el territorio nacional”, and the scope rules that once extended it lived in that same orphaned text.

The portable lesson

Even if you never practise in Mexico, the structural point travels: a privacy notice and a clinical consent are usually two different instruments, with different legal bases, mandatory contents and failure modes, and signing one does not do the work of the other. Find out which your own jurisdiction requires, and verify them at the source rather than from a template. Your remaining duties as a data controller — security, breach notice, confidentiality that outlives the relationship, and responsibility that does not transfer when you hire a vendor — are covered in the guide to using AI with patient data.

The notice itself is yours to write, and so is what your consents say and whether they satisfy article 8; no tool can do that for you. What can be kept in order is where they live — each signed consent in the chart rather than loose in a folder nobody can find when an access request arrives with twenty business days running. In gesell.ai, informed consents are signed digitally and archived in each client’s chart alongside the clinical history, treatment plan and session notes. Ask us the same questions you would ask any vendor before trusting it with sensitive data.