• Jurisdiction official name: United Mexican States (Estados Unidos Mexicanos).
• Legal system type: Civil law system with a federal structure, codified statutes, and limited binding precedent based on consistent higher-court rulings.
• Primary language(s) of law/government: Spanish
• General Description of RIM landscape: Mexico’s recordkeeping framework is driven by federal obligations covering tax documentation, accounting books, payroll and employment files, social security records, and regulated industry reporting. Key requirements arise under the Commercial Code, Federal Tax Code, Federal Labor Law, Social Security Law, and sector-specific regulations. Mexico’s privacy regime also affects retention and disposal practices where personal data is involved, particularly for employee and consumer information.

Zasio Research Scope & Depth

Total Zasio citations captured: 817

Primary sources relied upon:

• Code of Commerce
• Federal Fiscal Code
• Federal Labor Law
• Social Security Law
• Federal Law on the Protection of Personal Data Held by Private Parties

Core Recordkeeping Obligations

• How long must businesses keep accounting records? Generally, 10 years (Code of Commerce)
• How long must employers keep personnel records? Generally, at least until employee termination plus 5 years (combination of the Federal Labor Law and Social Security Law).
• Industries most heavily regulated:
  • Financial services and banking
  • Energy (oil, gas, electricity)
  • Pharmaceuticals, medical devices, and health services
  • Manufacturing and cross-border trade, which face customs

Other Notable retention timeframes:

• • Customs records: 5 years
  • AML/CFT records: 5 years from the date of the relevant transaction.
  • Personal data: Delete once it is no longer needed for its original purpose.
  • Corporate constitutive acts, capital changes, mergers, and spin-offs: for the life of the entity.

Mexico is one of the world’s most advanced adopters of continuous transaction controls (CTCs) and real-time electronic tax reporting. Most taxable business transactions, including payroll, invoices, credit notes, and many transportation and export documents, must be generated as structured XML records. In practice, this means the Mexican tax authority has near-immediate visibility into commercial activity across the economy.

Mexico is the United States’ largest goods trading partner and a critical manufacturing and nearshoring hub for North America. Also, the 2025 data protection reform (new authority, expanded retention and deletion obligations, new specialized federal courts), and a labor framework with strong employee-favorable presumptions when records are missing.

Impacted Organizations

• Multinational manufacturers and with Mexican operations and U.S./Canadian supply chains.
• Retailers, e-commerce, and B2C companies.
• Financial services.
• Businesses processing personal data of Mexican residents, including foreign controllers using means located in Mexico.

Zasio’s Mexico research gives records, privacy, and compliance teams a defensible basis for retention schedules that reconcile the 10-year commercial standard, the 5-year tax standard, employment-relationship-based labor retention, and data protection requirements.

Mexico recently restructured its data protection enforcement framework by moving oversight authority into the executive branch and assigning dispute review to specialized federal courts, creating ongoing uncertainty as enforcement practices, regulatory guidance, and compliance expectations continue to evolve.

Article 320 of Mexico’s Federal Labor Law requires employers using home-based production workers to maintain a labor-authorized worker register with prescribed employment and wage information that must remain permanently available (ongoing availability, not permanent retention) for labor inspection upon request. The applies to genuine home-based production and piecework arrangements, not ordinary remote office work, which is governed separately under Mexico’s telework rules.

Disclaimer: The purpose of this post is to provide general education on records management solutions. The statements are informational only and do not constitute legal advice. Any references to legal or regulatory recordkeeping requirements are provided for general guidance purposes and may not reflect all obligations applicable to your organization. Additional or alternative requirements may apply based on your organization’s industry, jurisdiction, risk profile, and specific business activities. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Recordkeeping and Information Governance in Mexico: Jurisdiction Overview appeared first on Zasio.