It is reported that Mexico’s telecommunications and broadcasting conformity assessment procedure, published in the Official Gazette (DOF) on 25/02/2020, created administrative frictions for the importation and certification of second-hand, rebuilt, or refurbished ICT products. Reported frictions relate, in particular, to the “Family/Model” approach (Art. 26) and to the non-transferability of conformity documents (Art. 7), which may require the re-issuance of conformity documentation where different economic operators, such as the manufacturer, importer, or distributor, must rely on it.
While the original 2020 procedure effectively excluded non-new products from the main certification schemes, an amendment published in the DOF on 27/12/2021 introduced a pathway to certify “non-new products” under a specific scheme. However, restrictions reportedly remain, as non-new products continue to be confined to that route and are not generally eligible under the broader certification schemes.

Pursuant to Art. 21 of Mexico’s Foreign Trade Act, the Secretariat of Economy (SE) may subject the importation and exportation of goods to prior permit requirements. Arts. 14–20 of the Regulation to the Act further set out the procedure for applying for these permits.
Under the Agreement establishing dual-use goods, software and technologies whose export is subject to regulation by the Ministry of Economy, exporters must obtain a prior permit for listed dual-use goods, software and technologies. The relevant ICT categories include specified high-performance or specially designed portable computers (HS 847130) and other computers or processing units (HS 847141, 847149 and 847150) under Category 4, as well as telecommunications base stations (HS 851761), data-transmission, routing and network equipment (HS 851762), other telecommunications apparatus (HS 851769) and related parts (HS 851770) under Category 5. Certain information-security and cryptographic products classified under these and other ICT headings are also covered.
The requirement applies only where the products meet the prescribed technical thresholds and therefore generally does not cover ordinary mass-market computers, mobile phones, routers, or other consumer ICT equipment. Controlled software and technology transmitted electronically are also treated as exports subject to prior authorisation. Permit applications are assessed by reference to the destination, end user and intended end use. The control annexes were updated in August and November 2022.

Until 2020, product certification in Mexico could be conducted only by certification bodies accredited by the Entidad Mexicana de Acreditación (EMA). For IT equipment and consumer electronics, the Mexican agency issuing certificates is the Underwriters Laboratories of Mexico.
The Law of Quality Infrastructure, which repealed the Federal Law on Metrology and Standardisation, allows for self-declaration of conformity if the standard bodies confirm that the Conformity Assessment Procedure includes the obligation by the goods producers (or services suppliers) to be accountable or if it does not affect the public interest (Arts. 60 and 69).

In February 2020, Mexico’s Instituto Federal de Telecomunicaciones (IFT) issued guidelines under Technical Provision IFT-012-2019, which entered into force in February 2021 and has been reported to create a significant barrier to trade for mobile telecommunications products. Reports indicate that the framework may delay time-to-market by requiring in-country testing for Specific Absorption Rate (SAR). It is also reported that the applicable requirements rely on standards considered outdated compared with more recent guidance from the International Electrotechnical Commission (IEC)/Institute of Electrical and Electronics Engineers (IEEE), as well as the International Commission on Non-Ionizing Radiation Protection (ICNIRP). In addition, the rules reportedly entail duplicative testing and may create bottlenecks, as Mexico has only a limited number of accredited facilities capable of performing the required tests.

It is reported that the conformity procedures of the Agreement, under which the Plenary of the Federal Telecommunications Institute issues the Conformity Assessment Procedure for Telecommunications and Broadcasting, contain worrying language requiring the sharing of test reports that may contain in-depth confidential information about ICT products.

Circular 12/2018 imposed quantitative limits on electronic payment fund accounts offered by electronic payment institutions in Mexico. Under Provision 15, individuals holding accounts denominated in foreign currency may withdraw funds and make card payments for a combined maximum of USD 10,000 per calendar month. Card payments from these accounts may be made only to beneficiaries located outside Mexico. The measure, therefore, imposes a direct monthly ceiling relevant to cross-border online payments.
Provision 9 establishes separate limits for accounts denominated in Mexican pesos, depending on the account level. Level 1 accounts may receive up to 750 Investment Units (UDIs, Unidades de Inversión) per month (approx. USD 378) and maintain a maximum balance of 1,000 UDIs (approx. USD 505). Level 2 accounts may receive up to 3,000 UDIs per month (approx. USD 1,514), while Level 3 accounts are not subject to a regulatory funding limit. These ceilings restrict the amount that users may receive or hold in their accounts and may therefore indirectly limit payments made through them.

Mexico does not apply a horizontal de minimis threshold, which is the minimum value of goods below which customs do not charge duties, across all trading partners. Yet, Rule 3.7.35 of the General Foreign Trade Rules for 2025 provides duty relief to specific, origin-based categories. For shipments from the United States and Canada, the de minimis threshold for customs duties is USD 117, while for countries covered by certain trade agreements, including Panama, the Pacific Agreement, and the Trans-Pacific Partnership, the applicable de minimis threshold is USD 1.

It is reported that, for patent applications in Mexico, applicants who are not resident in the country must act through a local agent.

The "Federal Law for the Protection of Personal Data in the Possession of Private Parties" applies conditions to transfers of personal data, which apply regardless of whether the data is transferred to national or foreign third parties. For any transfer, the company must inform those third parties of the privacy notice and the purposes for which the data subject has authorised the processing of their data (Art. 35). According to Art. 2, the privacy notice is the document made available to the data subject in physical, electronic, or any other format at the time their personal data are collected, with the purpose of informing them of the intended uses of their data. Art. 35 also requires that the processing of personal data follow the terms set out in the privacy notice, which must specify whether the data subject consents to the transfer, and the receiving third party must assume the same obligations as the transferring controller. Art. 36 further establishes that national or international data transfers may take place without the data subject’s consent when specific conditions are met, including when the transfer is required by law or treaty, necessary for medical prevention, diagnosis, treatment, or healthcare management, carried out within a corporate group under common control, required by a contract concluded or to be concluded in the data subject’s interest, necessary or legally mandated to safeguard the public interest or to pursue or administer justice, required for the recognition, exercise, or defence of a right in judicial proceedings, or necessary for maintaining or fulfilling a legal relationship between the controller and the data subject.
Similar limitations on the transfer of personal data were already contained in the earlier statute of the same name, now repealed, where comparable provisions were set out in Arts. 36 and 37.

It is reported that concerns persist regarding the duration of administrative and judicial proceedings for patent and trademark infringement, and that infringement may continue while cases remain pending.

Mexico has joined several agreements with binding commitments to open transfers of data across borders. These include: the Mexico-Panama Free Trade Agreement (Art. 14.10), the First Amending Protocol [which amends the Additional Protocol to the Framework Agreement of the Pacific Alliance (Arts. 13.11 and. 13.12(c)], the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11.2), and the United States-Mexico-Canada Agreement (USMCA, Art. 19.8.6).

Mexico is a party to the Patent Cooperation Treaty (PCT).

The new Federal Law for the Protection of Personal Data in the Possession of Private Parties, enacted in 2025, establishes a comprehensive framework for data protection in Mexico. It supersedes the 2010 law of the same name, which had likewise introduced an extensive regime governing the protection of personal data.

Mexico has a copyright regime under the Federal Copyright Act. However, the exceptions do not follow the fair use or fair dealing model, therefore limiting the lawful use of copyrighted work by others. Art. 148 and the following list the exceptions, which include the reproduction of: parts of the work for scientific, literary or artistic criticism and research; of a single copy by an archive or library for security and preservation reasons, and which is out of print, out of print and in danger of disappearing; among others.

Under section 183 of the Telecommunications and Broadcasting Act, telecom operators must retain certain data for the first 12 months in systems that allow real-time consultation and delivery to the competent authorities through electronic means. The data includes:
- the name or corporate name and address of the subscriber;
- the type of communication service, messaging or multimedia services
- data necessary to trace and identify the original and destination of mobile telephone communications, including the destination number and whether the line is the subject of a contract or tariff plan or is prepaid;
- data necessary to determine the date, time and duration of the communication, as well as the messaging or multimedia service;
- the date and time of the first activation of the service and the location label (cell identifier) ​​since the service was activated;
- identification and technical characteristics of the devices, including the international equipment and subscriber identity codes (where applicable); and
- the digital location of the geographical positioning of telephone lines.
At the end of the 12 months, the operator must keep the data for an additional 12 months in electronic storage systems. During this time, information must be delivered to the competent authorities within 48 hours.
It reported that all processing and storage systems used by operators and authorised persons in this regard must be located exclusively in Mexico; however, this is not clear from the regulatory text.