Mexico Legal Mini‑FAQ — Employee Monitoring, Consent, Notice and Proportionality

Do we need employee consent to monitor company devices

Not necessarily for ordinary employee personal data when processing is necessary for the employment relationship and disclosed in the privacy notice. Express consent is generally required for sensitive data. Avoid monitoring private communications or personal accounts.

Is advance notice required

Yes. Provide a clear privacy notice describing what you collect, why, legal basis, who can access it, retention, transfers, and ARCO rights. Give workers an on‑boarding notice and keep it accessible.

What does proportionality mean in practice

Use the least intrusive tool that achieves the stated purpose. For telework, Article 330‑I of the Federal Labor Law requires that any technology used to monitor teleworkers be proportionate to its purpose and respect privacy. Limit scope to work apps and hours, prefer sampling over constant recording, and restrict access.

Can we record screens or take periodic screenshots

Yes when justified, disclosed, and limited to company devices for work purposes. Set short default retention, for example 14 to 30 days, and restrict access to admins. Avoid capturing personal content and turn off recording when outside work hours.

What are ARCO rights and how do we handle them

ARCO stands for Access, Rectification, Cancellation and Opposition. Provide a channel to receive requests, verify identity, respond within the legal timeframe, and document outcomes. Update or delete data when applicable and inform requesters of results.

Can we transfer monitoring data outside Mexico

Cross‑border transfers are allowed but require informing data subjects in the privacy notice and using appropriate contractual safeguards with recipients. Keep an inventory of processors and ensure they provide comparable protections.

How long can we retain monitoring data

Keep it only as long as necessary for the stated purpose, then delete or anonymize. Adopt a written retention schedule and audit adherence. Longer retention may be justified for an active investigation or legal obligation.

Does NOM‑037 impose specific privacy duties

NOM‑037 focuses on occupational safety and health in telework and requires a written telework policy. Align that policy with your privacy notice by describing monitoring scope, tools, and support channels.

Can we monitor personal or BYOD devices

Prefer company devices. If BYOD is permitted, use containerized work profiles and limit collection to corporate apps and data. Obtain explicit acknowledgment of scope in policy, and provide a way to disable monitoring when off duty.

What should our privacy notice include

Identity of the controller, purposes, legal basis, data categories, transfers, retention, ARCO process, and how to revoke consent when applicable. Link this page in your employee handbook and telework policy.