Data Protection · Human Resources · Compliance

04/08/2026

Biometric data in your company: legal obligations you cannot ignore

A 42.8 million peso fine and a new labor obligation taking effect in 2027 raise the cost of improvising with fingerprints, faces, or voice.

On July 12, 2026, the Secretaría Anticorrupción y Buen Gobierno announced a fine of 42,849,095 pesos against the Mexican Football Federation for the improper processing of biometric data belonging to fans registered in the FAN ID system. The resolution may still be challenged, but the authority's message is clear: the use of this information is under increasingly strict scrutiny.

This is not just a sports issue

Thousands of companies use fingerprints, facial recognition, or iris scanning every day to control access, record attendance, and authenticate users. They almost always choose the technology for operational convenience, yet rarely review the legal obligations that come with deploying it.

Why these data call for heightened care

A fingerprint, a face, or a voice identifies a person uniquely. If that information is leaked or compromised, the harm is permanent and can lead to serious risks such as identity theft or fraud. For that reason, Mexican law classifies these data as sensitive personal data and requires a higher standard of protection.

To mitigate these risks, the law requires you to meet strict requirements:

1. Privacy notice. It must clearly state that the processing involves sensitive data.
2. Specific purposes. Define precisely what the data will be used for.
3. Express written consent. Obtained from the data subject through a handwritten signature, an electronic signature, or an equivalent authentication mechanism.
4. Security measures. Physical, technical, and administrative, proportionate to the risk of the processing.

The mistake of confusing labor law with privacy law

Many employers assume that because the individuals are their own employees and an employment relationship exists, they can install biometric systems without further legal implications. That is not the case. Labor law and data protection law govern different matters and create independent obligations.

This is where the greatest exposure lies for companies:

1. Under labor law. The reform to the Federal Labor Law requires employers to keep an electronic record of each employee's working time. For that record to carry full evidentiary weight, it must be shown that the mechanism was formally agreed between employee and employer.
2. Under privacy law. The law requires express written consent to process biometric information.
3. The governing rule. These obligations serve different purposes. Meeting one does not relieve you of the other. Confusing them exposes you to review and penalties from two separate authorities.

The clock is running: the calendar factor

The gradual reduction of the workweek and the enforceability of the electronic working-time record both begin on January 1, 2027. The Ministry of Labor and Social Welfare has not yet published the applicable general provisions. The law sets no deadline for it to do so, but those rules must exist before that date. You have time to prepare, and that time is running.

What to review in your company

Deploying biometric technology is not simply a software purchase. It is an integrated decision about regulatory compliance and corporate risk management. Review these points today:

1. Privacy notice. It states that the data are sensitive, and its stated purposes match actual use.
2. Consent. Collected in the form the law requires and retained as evidence.
3. Transfers and security. Transfers to outside vendors are authorized, and your security measures align with the law.
4. Employment documentation. The agreement to record working time through biometrics is documented and signed in the individual employment agreement.

The cost of reviewing too late

The Mexican Football Federation case shows that prevention remains the cheapest option. Reviewing your privacy notices, internal policies, and employment documentation in time can be the difference between a successful technology rollout and an administrative proceeding with multimillion-peso consequences.

Do you know with certainty whether your company currently meets its obligations for the use of biometric data?

At ChessMap we guide companies through this full review: privacy notice, consent records, vendor agreements, and individual employment agreements. If you would like to explore where your organization stands, we would be glad to set up a conversation.

This article was prepared by Gustavo Hernández Cruz, Licensee of ChessMap®, with the support of artificial intelligence tools for research and editing. The content was reviewed, verified, and approved by the author, who assumes authorship and sole responsibility for it. The opinions and interpretations are the author's own and do not represent the institutional position of ChessMap®, which acts solely as a publishing platform. This material is for informational purposes and general commentary only. It does not constitute legal advice or a legal opinion, and it does not create an attorney-client relationship. For any specific matter, we recommend obtaining tailored professional advice. The provisions cited may be amended. Verify the version in force or consult us before making decisions.