Mexico’s path to cannabis legalization has been anything but straightforward. What started with the legalization of medical and scientific use in 2017 (Ley General de Salud reform) evolved through a series of Supreme Court rulings, legislative attempts, and regulatory hesitations into a market that — in 2026 — is finally beginning to function with some regulatory clarity.

For operators navigating Mexican cannabis compliance, the relevant body is COFEPRIS — the Comisión Federal para la Protección contra Riesgos Sanitarios (Federal Commission for the Protection against Sanitary Risk). Understanding COFEPRIS’s requirements, combined with Mexico’s data protection framework, is essential for anyone operating in or sourcing from this North American market.

2017: Reform to the Ley General de Salud and the Reglamento de la Ley General de Salud en Materia de Control Sanitario para la Producción, Investigación y Uso Medicinal de la Cannabis y sus Derivados Farmacológicos. This created the first formal legal pathway for medicinal cannabis — but implementation was slow.

2019-2021: COFEPRIS issued early guidance, but the adult-use question remained legally contested. Mexico’s Supreme Court (SCJN) ruled in 2021 that blanket criminalization of adult recreational use was unconstitutional. This created a legal vacuum — courts decriminalized possession without legislative action to license retail sales.

2021-2024: Legislative attempts to pass a comprehensive cannabis regulatory framework repeatedly stalled in the Mexican Congress. The legal grey zone continued.

2025-2026: Regulatory maturation in the medical sector. COFEPRIS has issued hundreds of medical use authorizations. An adult-use framework remains legislatively incomplete, but medical cannabis is operating under clearer rules and regulatory pressure to comply is real.

COFEPRIS Licensing Framework

COFEPRIS manages all pharmaceutical-grade cannabis authorizations. The key permit types:

Autorización Sanitaria para el Uso Medicinal y Científico del Cannabis: The master authorization enabling licensed activities. Companies must have this before any cultivation, production, or distribution.

Permiso de cultivo: Growing permits are site-specific and crop-specific. Companies must document cultivation practices and report data to COFEPRIS.

Permiso de producción: For processing and manufacturing cannabis-derived pharmaceutical products.

Permiso de importación/exportación: Mexico is an importer of cannabis-derived ingredients used in pharmaceutical manufacturing. Exporters from other countries must work within the INCB authorization framework.

Prescripción médica: Patients access medicinal cannabis through licensed physicians. COFEPRIS maintains records of authorizations, and pharmacies dispensing cannabis products have reporting obligations.

Documentation Requirements

COFEPRIS licensing creates substantial documentation obligations:

  • Cultivation records (seed source, planting dates, growing conditions, pest management, harvest data)
  • Laboratory test results (cannabinoid content, contaminants — mandatory for every batch)
  • Supply chain records (traceability from cultivation through sale)
  • Distribution records (who received what product, in what quantity, when)

These records must be available for COFEPRIS inspection. Inspection can be unannounced. Records that are incomplete, inaccurate, or cannot be produced promptly are inspection findings that can result in suspension or revocation of authorization.

Mexico’s Data Protection Framework

Mexico’s primary personal data protection law is the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) — the Federal Law on Protection of Personal Data Held by Private Parties — enacted in 2010 and regulated by INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales).

Key principles under LFPDPPP relevant to cannabis operators:

Notice (Aviso de privacidad): Every company collecting personal data must provide a Privacy Notice (Aviso de privacidad) explaining what data is collected, for what purpose, with whom it is shared, and how individuals can exercise their rights. Cannabis operators — employers, patient programs, suppliers — must maintain current Avisos de privacidad.

Consent: Sensitive personal data (which includes health data) requires express, written consent for collection and processing. Patient medical cannabis data is sensitive personal data — consent must be documented.

ARCO Rights: Data subjects have rights of Acceso (access), Rectificación (correction), Cancelación (cancellation/deletion), and Oposición (objection). Companies must have procedures to respond to ARCO requests within 20 business days.

Data Security (Article 19 LFPDPPP): The data controller must implement administrative, technical, and physical security measures appropriate to the nature and volume of personal data held. INAI has issued guidelines on what these measures should include, including:

  • Access controls
  • Encryption for sensitive personal data
  • Secure storage
  • Employee training
  • Incident response procedures

Breach Notification (Article 20 LFPDPPP): Security incidents compromising personal data must be immediately communicated to data subjects so they can take protective measures. Unlike GDPR’s 72-hour regulatory notification requirement, LFPDPPP focuses on individual notification — but INAI expects to be notified of significant incidents as a matter of best practice.

INAI Registration: Unlike some jurisdictions, LFPDPPP does not require formal registration of all databases. However, INAI can request information about any company’s data protection practices during an investigation.

Penalties: LFPDPPP fines range from 100 to 320,000 times the daily minimum wage (approximately MXN 230,000 to MXN 741 million — up to roughly USD 36 million at 2026 exchange rates). Health data violations are in the higher penalty bands.

Cybersecurity Implications for Cannabis Operators

COFEPRIS Digital Platforms

COFEPRIS has been expanding its digital infrastructure for license management and compliance reporting. Operators submit applications, reports, and notifications through government digital portals. Cybersecurity requirements for these portals:

  • Credential security: COFEPRIS portal credentials must be protected. These accounts control your regulatory authorization — a compromised account can submit false reports or trigger license reviews.
  • MFA where available: Not all COFEPRIS portals support MFA. Where they do, enable it. Where they don’t, use strong unique passwords and consider whether your portal access qualifies as a regulated system requiring additional controls.
  • Document integrity: Compliance documents submitted to COFEPRIS should be retained in original form — do not modify submitted documents after submission. Discrepancies between submitted records and retained copies can constitute a regulatory violation.

Prescription and Patient Data

Cannabis prescriptions in Mexico create patient data — prescription number, patient name, physician’s license, product, quantity. This data may flow through:

  • Pharmacy systems: Dispensing pharmacies hold prescription records for cannabis products. Pharmacy systems in Mexico vary widely in sophistication; many independent pharmacies use basic POS systems with minimal security controls.
  • Physician records: Prescribers maintain patient records including diagnosis and prescribing history. These are subject to LFPDPPP as sensitive health data.
  • Patient assistance programs: Some manufacturers operate patient support programs that collect additional health information. These programs require full LFPDPPP compliance including Avisos de privacidad, ARCO procedures, and security measures.

Supply Chain Data

Mexico’s cannabis supply chain — from licensed cultivators through processors to distributors and pharmacies — generates traceability data that must be maintained securely:

  • Batch records: Cultivators and manufacturers maintain batch records. In Mexico’s developing regulatory environment, many companies still use paper-based batch records. Paper records present physical security risks (fire, theft, water damage) and cannot satisfy audit trail requirements as reliably as electronic systems.
  • Transportation records: Distribution of pharmaceutical-grade cannabis requires documentation of chain of custody. Vehicle GPS data, driver records, delivery receipts — all are part of the compliance record and may contain personal data subject to LFPDPPP.
  • Third-party laboratory records: Mexico requires testing by COFEPRIS-approved laboratories. Laboratory data — certificates of analysis, raw instrument data — is both compliance documentation and commercially sensitive. Secure transmission of CoAs between labs and operators, and secure retention, are requirements.

North American Cannabis Data Flows

Mexico’s position in North America creates specific cross-border data flow considerations:

US-Mexico data flows: U.S. cannabis companies sourcing ingredients from Mexico (certain hemp-derived cannabinoids move across the border under existing import rules) may send purchase data, specification documentation, and supplier audit records to Mexican partners. LFPDPPP’s rules on cross-border transfers apply to the Mexican side. The U.S. side is governed by the applicable state laws (CCPA if California-based, etc.).

Canada-Mexico: Canada’s PIPEDA/Law 25 equivalent rules apply to Canadian companies receiving personal data from Mexican suppliers.

Maquiladora-model cannabis processing: Some U.S. cannabis companies have explored Mexico as a contract manufacturing base (hemp-derived cannabinoid extraction and processing). This creates a manufacturing data relationship with full LFPDPPP obligations for the Mexican processor.

Common Compliance Gaps in Mexican Cannabis Operations

Based on the regulatory landscape and COFEPRIS inspection patterns, the most common compliance failures in Mexican cannabis include:

  1. Outdated or missing Avisos de privacidad: Many early-stage operators don’t have current privacy notices aligned with LFPDPPP — or have template notices that don’t reflect their actual data practices.

  2. No ARCO procedures: Companies without documented procedures for responding to data subject requests are routinely non-compliant.

  3. Paper-only batch records with no backup: Physical records stored at production facilities with no digital copy and no offsite backup are vulnerable to loss.

  4. Unsecured COFEPRIS portal credentials: Shared login credentials or weak passwords for regulatory portal access.

  5. Third-party vendor data processing without contracts: Companies using Mexican or US-based SaaS tools for compliance management without data processing agreements.

  6. No breach response plan: LFPDPPP breach notification obligations require prompt individual notification — companies without incident response plans can’t comply in a timely way.

Compliance Checklist for Mexican Cannabis Operators

  • Obtain and maintain current COFEPRIS authorizations for all licensed activities
  • Implement Avisos de privacidad for all personal data collection contexts (employees, patients, suppliers, B2B contacts)
  • Document ARCO request procedures — response within 20 business days
  • Classify data by sensitivity — health data of patients requires enhanced security measures
  • Implement electronic batch records with audit trails, or at minimum digitize paper records with offsite backup
  • Secure COFEPRIS portal credentials — unique strong passwords, MFA where available
  • Execute data processing agreements with any third-party SaaS providers holding your compliance or patient data
  • Develop breach response plan aligned with LFPDPPP Article 20 individual notification requirement
  • Train employees on LFPDPPP obligations — documented training records
  • Review cross-border data transfer practices for LFPDPPP compliance

What to Watch in 2026

Mexico’s cannabis regulatory environment continues to evolve:

Adult-use legislation: Congressional action on adult recreational use remains possible in 2026. If passed, a retail licensing framework will create a significantly larger regulatory compliance footprint.

LFPDPPP reform: Mexico has signaled intent to modernize its data protection framework, potentially moving closer to GDPR standards. An updated law could include mandatory breach notification to INAI (not just individuals), DPO requirements for large processors, and higher fines.

COFEPRIS digital enforcement: COFEPRIS is improving its digital inspection tools. Companies that have been maintaining compliance informally should expect more structured audit requests.

Mexico’s cannabis market offers significant opportunity for operators willing to navigate its regulatory complexity. The compliance infrastructure required — pharmaceutical-grade record keeping, LFPDPPP privacy controls, COFEPRIS digital compliance — is demanding but well-defined. Operators who build it correctly from the start will be far better positioned as the market expands.

For the broader Latin America compliance picture, see our Latin America Cannabis Compliance hub.