Mexico subjects certain foreign acquisitions to prior authorisation by the National Commission on Foreign Investment (CNIE). Under Art. 9 of the Foreign Investment Act, CNIE approval is required where a foreign investor seeks to acquire, directly or indirectly, more than 49% of a Mexican company and the target company’s total assets exceed the annual threshold determined by the CNIE. In 2025, the threshold is set at approximately USD 1.6 million.
In assessing authorisation requests, the CNIE considers, inter alia, expected effects on employment and training, the investment’s technological contribution, compliance with environmental requirements, and impacts on competitiveness, and it may impose only conditions that do not distort international trade (Art. 29). The CNIE may also deny authorisation on national security grounds (Art. 30).

There are concerns that Art. 50 of the Provisions on Electronic Payment Fund Institutions might force firms to choose only cloud providers based in Mexico, thus indirectly imposing a local data processing requirement. The law requires electronic payment fund institutions to use secondary cloud services provided by a company that is not subject to a different jurisdiction. That would mean that the secondary cloud provider would need to be subject to the Mexican jurisdiction and, therefore, be located in the country.

It is reported that, for patent applications in Mexico, applicants who are not resident in the country must act through a local agent.

The "Federal Law for the Protection of Personal Data in the Possession of Private Parties" applies conditions to transfers of personal data, which apply regardless of whether the data is transferred to national or foreign third parties. For any transfer, the company must inform those third parties of the privacy notice and the purposes for which the data subject has authorised the processing of their data (Art. 35). According to Art. 2, the privacy notice is the document made available to the data subject in physical, electronic, or any other format at the time their personal data are collected, with the purpose of informing them of the intended uses of their data. Art. 35 also requires that the processing of personal data follow the terms set out in the privacy notice, which must specify whether the data subject consents to the transfer, and the receiving third party must assume the same obligations as the transferring controller. Art. 36 further establishes that national or international data transfers may take place without the data subject’s consent when specific conditions are met, including when the transfer is required by law or treaty, necessary for medical prevention, diagnosis, treatment, or healthcare management, carried out within a corporate group under common control, required by a contract concluded or to be concluded in the data subject’s interest, necessary or legally mandated to safeguard the public interest or to pursue or administer justice, required for the recognition, exercise, or defence of a right in judicial proceedings, or necessary for maintaining or fulfilling a legal relationship between the controller and the data subject.
Similar limitations on the transfer of personal data were already contained in the earlier statute of the same name, now repealed, where comparable provisions were set out in Arts. 36 and 37.

It is reported that concerns persist regarding the duration of administrative and judicial proceedings for patent and trademark infringement, and that infringement may continue while cases remain pending.

Mexico has joined several agreements with binding commitments to open transfers of data across borders. These include: the Mexico-Panama Free Trade Agreement (Art. 14.10), the First Amending Protocol [which amends the Additional Protocol to the Framework Agreement of the Pacific Alliance (Arts. 13.11 and. 13.12(c)], the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11.2), and the United States-Mexico-Canada Agreement (USMCA, Art. 19.8.6).

Mexico is a party to the Patent Cooperation Treaty (PCT).

The new Federal Law for the Protection of Personal Data in the Possession of Private Parties, enacted in 2025, establishes a comprehensive framework for data protection in Mexico. It supersedes the 2010 law of the same name, which had likewise introduced an extensive regime governing the protection of personal data.

Mexico has a copyright regime under the Federal Copyright Act. However, the exceptions do not follow the fair use or fair dealing model, therefore limiting the lawful use of copyrighted work by others. Art. 148 and the following list the exceptions, which include the reproduction of: parts of the work for scientific, literary or artistic criticism and research; of a single copy by an archive or library for security and preservation reasons, and which is out of print, out of print and in danger of disappearing; among others.

Under section 183 of the Telecommunications and Broadcasting Act, telecom operators must retain certain data for the first 12 months in systems that allow real-time consultation and delivery to the competent authorities through electronic means. The data includes:
- the name or corporate name and address of the subscriber;
- the type of communication service, messaging or multimedia services
- data necessary to trace and identify the original and destination of mobile telephone communications, including the destination number and whether the line is the subject of a contract or tariff plan or is prepaid;
- data necessary to determine the date, time and duration of the communication, as well as the messaging or multimedia service;
- the date and time of the first activation of the service and the location label (cell identifier) ​​since the service was activated;
- identification and technical characteristics of the devices, including the international equipment and subscriber identity codes (where applicable); and
- the digital location of the geographical positioning of telephone lines.
At the end of the 12 months, the operator must keep the data for an additional 12 months in electronic storage systems. During this time, information must be delivered to the competent authorities within 48 hours.
It reported that all processing and storage systems used by operators and authorised persons in this regard must be located exclusively in Mexico; however, this is not clear from the regulatory text.

It is reported that copyright enforcement in Mexico remains insufficient in the online environment. Stakeholders indicate that Mexico continues to experience high levels of infringement through multiple channels, including unauthorised streaming services, peer-to-peer networks, direct-download sites, stream-ripping, circumvention tools for video games and consoles, and the distribution of infringing content via physical media. As internet access expands, online piracy is reported to be increasing, and stakeholders have characterised Mexico as a significant market for music and video game piracy. Stakeholders also continue to report notable levels of piracy facilitated by illicit streaming devices and unauthorised Internet Protocol television (IPTV) applications.

Mexico has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.

Mexico has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Mexico’s Federal Law for the Protection of Industrial Property establishes a framework for trade secret protection, including safeguards against unlawful disclosure. The Law provides for both administrative and criminal enforcement mechanisms, including administrative infringements (Art. 386) and criminal offences relating to trade secrets (Art. 402).
However, it is reported that the Conformity Assessment Procedure for Telecommunications and Broadcasting issued by the Plenary of the Federal Institute of Telecommunications (DOF: 25 February 2020) has raised confidentiality concerns, insofar as it contemplates the submission of test reports that may contain detailed confidential information on ICT products. While the amendment to the 2021 Agreement has reportedly addressed earlier concerns about the automatic sharing of such reports, regulators may still request test reports in specific cases, which continues to generate trade secret and confidentiality risks for ICT manufacturers.

Mexico’s Federal Law for the Protection of Industrial Property establishes a framework for the protection of trade secrets. Title III of the Act defines trade secrets and misappropriation, recognises lawful means of acquisition, and provides administrative enforcement mechanisms to protect trade secrets.