What security obligations are imposed on data controllers and data processors?
Security requirements may not always be included in the data protection law, but are key to guaranteeing lawful processing of personal data. The entity processing the data must take all useful precautions with respect to the nature of the data and the risk presented by the processing, to preserve the security of the data and prevent alteration, corruption or access by unauthorized third parties.
Employers in Mexico are responsible for establishing and maintaining administrative, technical and physical security measures to protect personal data from damage, loss, destruction, alteration or unauthorized use/access/processing. When assessing which measures to implement, consider the potential risks associated with the personal data, the level of sensitivity, the possible consequences and the available technology (Federal Law on the Protection of Personal Data Held by Private Parties, 2010). Employees and third-parties who process data must maintain confidentiality, even after the end of their relationship with the employer.
HR Best Practices: Ensure contracts with service providers detail the security and confidentiality measures that will be implemented. In addition, regularly train employees who may have access to personal information, to ensure that they are following all technical and organizational security measures that have been put in place.