Employee Background Checks in Mexico (2026 Guide)

Background checks are legal in Mexico. There is no federal law that prohibits them, and no types of checks are expressly forbidden, as long as the process follows two overlapping frameworks.

Mexico's data protection law (LFPDPPP) and its anti-discrimination provisions under the Federal Labor Law and the Constitution both apply.

For foreign companies hiring in Mexico, the compliance detail is in the process, not the permission.

Getting consent wrong or requesting data in Mexico's 'sensitive personal data' category creates legal exposure that the underlying business purpose does not justify.

This guide covers what you can check, what you cannot, how the consent process must work, and how background checks interact with an EOR employment structure.

Key takeaways

• Background checks are legal in Mexico for all types of verification, provided proper written consent is obtained before the process begins.
  
  

• Explicit written consent is mandatory. Verbal consent is not sufficient. The candidate must sign a consent form and receive a privacy notice (aviso de privacidad) before any data is collected.
  
  

• ARCO rights apply to all candidates. Any person whose data is collected has the right to access, rectify, cancel, and object to the processing of their data at any time, including revoking consent after it has been given.
  
  

• Sensitive personal data requires a higher consent standard. Medical history, biometric data, and similar categories require explicit rather than implied consent and cannot be used as hiring criteria in most circumstances.
  
  

• Pregnancy and HIV tests are prohibited as hiring criteria. Requiring these tests, or using the results to make a hiring decision, violates Mexico's anti-discrimination framework.
  
  

• The enforcement authority changed in March 2025. INAI was dissolved; enforcement of LFPDPPP now sits with the Secretaría Anticorrupción y Buen Gobierno.
  
  

• Criminal records are not accessible through a single centralized database. Mexican employers verify through multiple state and federal registries, which vary in accessibility and completeness.
  
  

• When using an EOR, the EOR is the formal employer. Confirm clearly which party (your company or the EOR) is responsible for running and documenting the background check process.
  
  

The legal framework governing background checks in Mexico

Two legal frameworks govern what employers can check and how.

LFPDPPP: Mexico's Data Protection Law and What It Requires

The Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) governs all personal data processing by private entities in Mexico.

For background checks, this means:

• Written consent required before data collection begins. The aviso de privacidad must be delivered and the candidate's consent documented before any verification is initiated.
  
  

• Purpose limitation. Data collected for a background check can only be used for that purpose. It cannot be stored for future use or shared with third parties without separate consent.
  
  

• Data minimization. Only data that is relevant to the employment decision can be collected. Collecting criminal records for a role where criminal history is not relevant creates LFPDPPP exposure.
  
  

• ARCO rights must be disclosed. The aviso de privacidad must explain how the candidate can exercise their rights to access, rectify, cancel, or object to the processing.
  
  

• Enforcement: The Secretaría Anticorrupción y Buen Gobierno (formerly INAI, dissolved March 2025) has authority to investigate complaints and impose fines.
  
  

Federal Labor Law: Anti-Discrimination Rules for Screening

Mexico's Federal Labor Law (LFT) and the Federal Law to Prevent and Eliminate Discrimination (LFPED) prohibit hiring decisions based on protected characteristics including pregnancy, disability, HIV status, sexual orientation, and gender identity.

This affects background checks in two ways:

• Medical and health tests cannot be used as hiring criteria for most roles. Requesting a pregnancy test or HIV test as a condition of employment is illegal regardless of whether the candidate consents.

• Criminal history must be role-relevant. Using criminal records to screen out candidates in roles where the criminal history is not directly relevant to job duties may constitute discriminatory practice, particularly for low-level offenses.

What you can legally check

Criminal Record Checks in Mexico

Criminal record verification in Mexico is legal with proper consent, but there is no equivalent of the US's centralized FCRA-governed system. Mexico uses multiple sources:

• REPUVE (Registro Público Vehicular): Vehicle registration records, relevant for roles involving company vehicles

• RNSP (Registro Nacional de Seguridad Pública): Federal public security data; limited employer accessibility

• State-level registries: Each state maintains its own records; completeness and accessibility vary significantly

• Third-party background check providers: Companies like Certn, First Advantage, and KROLL offer Mexico criminal background screening through aggregated state and federal data sources

Criminal history checks are most defensible for roles involving financial responsibility, access to sensitive data, work with vulnerable populations, or security functions.

Employment History and Reference Verification

Verifying prior employment dates, titles, and basic factual information is standard practice and carries no specific legal restriction beyond the general LFPDPPP consent framework.

Reference checks that go beyond factual verification (asking former employers about performance, conduct, or reasons for departure) are legal but must be limited to information relevant to the role.

Education, Degree, and Professional License Verification

Verification of academic degrees, professional certifications, and licenses is straightforward and legally uncontroversial when conducted with candidate consent.

In Mexico, the Secretaría de Educación Pública (SEP) maintains a public registry of recognized institutions and degrees.

For licensed professional roles (engineers, attorneys, architects, accountants), the Dirección General de Profesiones issues cédula profesional numbers that can be verified publicly.

Pre-Employment Drug Testing in Mexico

Pre-employment drug testing is legal in Mexico with written candidate consent. Employers in safety-sensitive industries (transportation, construction, industrial operations) commonly require it.

Drug test results are sensitive personal data under the LFPDPPP and require explicit rather than implied consent.

Results can only be used for the employment decision and cannot be shared without separate authorization.

Credit and Financial History Checks

Credit checks are legal in Mexico with consent and are regulated by the CONDUSEF (Comisión Nacional para la Protección y Defensa de los Usuarios de Servicios Financieros).

They require the candidate's signed authorization.

Credit checks are defensible for roles with financial authority, treasury functions, or fiduciary responsibility. Running a credit check for a software engineer without financial role responsibilities creates unnecessary legal exposure.

Verifying Professional Licenses and Cédula Profesional

Verification of professional licenses and registrations is public information in most cases and does not require special consent processes beyond the standard aviso de privacidad.

What you cannot use as hiring criteria

Pregnancy Tests: Prohibited as a Hiring Criterion

Requiring a pregnancy test as a condition of employment or using a positive result to deny an offer is illegal under the LFT and LFPED.

This prohibition is absolute. It applies regardless of whether the candidate consents to the test.

HIV Tests: Prohibited Under Anti-Discrimination Law

Requiring an HIV test as a condition of employment or using the result in a hiring decision is prohibited under Mexican anti-discrimination law. A candidate cannot waive this protection through consent.

General Medical Examinations: Role-Specific Use Only

General medical examinations to assess overall health status are not a permissible hiring criterion for standard roles.

Medical checks are defensible only where specific physical requirements are directly and demonstrably tied to the job duties, for example visual acuity for commercial drivers or physical fitness for safety-sensitive industrial roles.

Mental Health History: Strict Sensitive Data Rules

Mental health information is sensitive personal data under the LFPDPPP. Collecting it requires explicit consent and a clear role-relevant justification.

Using mental health history as a disqualifying factor is legally risky and likely discriminatory.

The consent process: what it must include

A compliant background check consent process in Mexico requires two documents:

1. Aviso de Privacidad: The Required Privacy Notice

The privacy notice must disclose:

• The identity and contact information of the data controller (your company or the EOR)

• The specific types of personal data being collected

• The purpose of the collection

• Any third parties with whom the data will be shared (background check providers, reference contacts)

• How the candidate can exercise their ARCO rights

• The retention period for the data collected

2. Signed Written Consent: What It Must Cover

A separate, explicit consent form signed by the candidate authorizing the specific background checks to be conducted. The consent must be:

• Written (not verbal, not implied)

• Specific to each type of check being conducted

• Given freely before the process begins

• Revocable at any time

If the candidate revokes consent after the check has been initiated but before completion, you may not use partial results in the hiring decision.

This is a practical operational risk for multi-week background check processes.

How background checks work when using an EOR in Mexico

When a foreign company uses an EOR to hire in Mexico, the background check question requires specific clarification before the process begins.

Who Is the Data Controller: Your Company or the EOR?

Under the LFPDPPP, the entity collecting and processing the candidate's personal data is the data controller with the compliance obligation. That could be:

• Your company: if you run the background check directly before the EOR employs the candidate

• The EOR: if the EOR conducts the background check as part of its onboarding process

• A third-party provider: acting as a data processor for either your company or the EOR

Get this in writing before onboarding begins. If your company runs the background check but the EOR's aviso de privacidad names the EOR as data controller, there is a compliance gap.

Who Bears LFPDPPP Liability for Consent Failures?

The entity named as data controller in the aviso de privacidad bears the LFPDPPP compliance obligation.

If your company conducts the check without a properly executed consent and aviso, your company is the liable party, not the EOR.

EOR Onboarding and Background Checks: Who Is Responsible

Most EOR providers do not conduct background checks as part of standard onboarding. They employ the person based on information you provide.

Running a background check is typically the client company's responsibility, or can be arranged as an add-on service.

Confirm with your EOR which party handles background check documentation and whether the EOR's standard aviso de privacidad covers the background check data processing or whether a separate document is required.

Compliant Background Check Checklist for Mexico Hiring

Before initiating any background check on a Mexico-based candidate:

• Prepare a Mexico-specific aviso de privacidad that identifies the data controller, lists the data types, states the purpose, names any processors, and explains ARCO rights

• Obtain a signed written consent form specific to the types of checks being conducted

• Confirm the checks are role-relevant before ordering them

• Do not request pregnancy tests, HIV tests, or general health assessments as hiring criteria

• Use a background check provider with documented Mexico-specific compliance practices

• Store consent documentation in a secure, accessible location for potential regulatory audit

• If the candidate revokes consent, stop the process and do not use partial results

• When using an EOR, confirm in writing who is the data controller for the background check data

Hire in Mexico with the right structure from day one

For foreign companies hiring in Mexico, the compliance obligations of a background check sit within the broader compliance structure of the employment relationship itself.

Human Resources Mexico (HRM) is a Mexico-only Employer of Record with 17 years of physical presence in Mexico. We provide the employment contract, IMSS registration, and CFDI payroll structure that gives every background check a proper legal foundation: a clearly identified employer, a documented employment relationship, and LFPDPPP-aligned data processing agreements as standard.

We do not conduct background checks on your behalf as part of standard EOR onboarding.

That responsibility stays with you as the engaging company. What we provide is the employment structure that makes every subsequent compliance step: background check consent, data retention, employment documentation, legally coherent.

Get a custom proposal from Human Resources Mexico (HRM) and see what compliant Mexico employment looks like from day one.

Have questions about LFPDPPP consent requirements, aviso de privacidad drafting, or how background checks interact with EOR structure? Ask our Mexico EOR Specialist AI Chatbot for immediate answers.

Frequently asked questions

Are background checks legal in Mexico?

Yes. Background checks are legal in Mexico for any type of verification: criminal records, employment history, education, credit, and drug testing.

Explicit written consent and an aviso de privacidad are required before the process begins.

Can employers in Mexico check criminal records?

Yes, with written candidate consent. Mexico does not have a single centralized criminal database accessible to employers.

Checks are run through state and federal registries or third-party screening providers that aggregate multiple sources.

Can Employers in Mexico Require a Pregnancy Test?

No. Requiring a pregnancy test or using the result to deny a job offer is illegal under Mexico's Federal Labor Law and the Federal Law to Prevent and Eliminate Discrimination.

This prohibition applies regardless of whether the candidate consents.

What is an aviso de privacidad and why is it required?

An aviso de privacidad is a privacy notice required under Mexico's LFPDPPP. It must identify the data controller, explain what data is collected, why, and who receives it.

It must also explain how the candidate can exercise their ARCO rights.

It must be delivered before any data is collected.

What are ARCO rights in Mexico?

ARCO stands for Acceso (access), Rectificación (rectification), Cancelación (cancellation), and Oposición (objection).

Under the LFPDPPP, any person whose data is collected has the right to request access to their data, correct errors, request deletion, or object to the processing at any time.

Who Enforces Data Protection Rules for Background Checks?

The Secretaría Anticorrupción y Buen Gobierno, which took over data protection enforcement from INAI in March 2025.

It can investigate complaints and impose fines on employers who collect data without proper consent or violate LFPDPPP requirements.