compliance · privacy
The new LFPDPPP keeps the principles model, changes the authority and sets fines of up to 320,000 UMA. What it means for recording your technicians' location, and how waydot sets it up.
A technician's location lets you assign the nearest one, verify arrivals, calculate mileage and respond to an emergency. It's also the data point that breeds the most distrust in a field team when the rules aren't clear. In Mexico, those rules come from the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), which was rewritten from scratch in 2025.
This article summarizes what the text says. It isn't legal advice; every company should review its own case with its lawyer.
The new law was published in the Official Gazette on March 20, 2025, replacing the 2010 law. Three changes matter here:
It depends on the purpose. Article 9, fraction IV, waives consent when the data "are required to exercise a right or fulfill obligations arising from a legal relationship" between the person and the company. Verifying that a visit happened can fit there. That doesn't waive the privacy notice: Article 15 requires stating which data are processed, for what, which purposes need consent, and how to exercise ARCO rights (access, rectification, cancellation and objection).
The law doesn't list location among sensitive data. But a location history outside working hours can reveal things that are sensitive, such as visits to a hospital or a place of worship. That's a good reason not to keep one.
Article 58 lists the infringements and Article 59 prices them. With the 2026 UMA at 117.31 pesos, the caps for three cases that apply directly to geolocation look like this:
| Maximum fine | |
|---|---|
| Incomplete privacy notice | MX$18.77 M |
| Using the data for a different purpose | MX$37.54 M |
| Security breach attributable to the company | MX$37.54 M |
LFPDPPP 2025, Articles 58 (fractions V, IX and XI) and 59; 2026 UMA of 117.31 pesos (INEGI). Millions of pesos, before the sensitive-data increase.
The second bar is the one that worries us most in practice. A route log meant for calculating mileage can easily end up used for something else. Article 11 requires asking for consent again to use data for a purpose other than the one in the notice.
Article 12 says processing must be "necessary, adequate and relevant" to the purposes. This is how we apply it in waydot:
In this arrangement, the company is the data controller and waydot acts as processor: it handles the data on the company's behalf and under its instructions.
Location-spoofing apps are easy to install. waydot detects signs like impossible position jumps or check-ins from emulators and flags them for human review. That's an indication, not proof; any disciplinary decision is made by a person with the full context.
A 30-minute briefing with your dispatch, payroll and asset flows on screen.
Keep reading
Mexico's tax code reform treats a CFDI invoice as false if it doesn't cover a real transaction, and gives the taxpayer five business days to prove it. Why waydot closes every visit with timestamped, located evidence.
Four dated legal changes and two infrastructure facts that belong in any evaluation of a field platform in Mexico, with the sources to check them.
Mexico's IMSS data for 2024 show 418,000 workplace accidents, 50% more than in 2020, and that half of workplace accidents and occupational diseases hit people with less than a year in their position. Why waydot puts the job safety analysis before the first task.
