Govern cross-border transfers under Articles 36-37 + Reglamento Articles 66 (international) and 68 (domestic). International transfers (Article 36) prohibited without informing data subject in Aviso de Privacidad + same purpose limitation + recipient agreement to same safeguards + recipient acceptance of LFPDPPP obligations. Reglamento Article 66 details for international transfers including written notification to data subject + transfer contract with recipient privacy obligations + recipient declaration of compliance + retention of evidence. Exceptions Article 37 including: legal/treaty obligation + medical emergency + parties processing + foreign companies needed for contract performance + judicial cooperation + recognition of judicial decisions. APEC CBPR pioneering economy (one of 9 APEC CBPR participants + first Latin American 2018) provides recognised cross-border transfer mechanism with Accountability Agent oversight. Mexico USMCA Article 19 (T-MEC in Spanish) cross-border data flow commitments alongside US and Canada. Reglamento Article 68 domestic transfers (within Mexico) require similar safeguards. Free transfers to recipients within same controller group. RIPD Ibero-American Network cooperation. EU GDPR adequacy assessment ongoing. Mexican exporters typically use written agreement with recipient + integrated into commercial contracts. 2025 reform may significantly change cross-border regime.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.