In Mexico, there is no specific regulation dedicated to governing workplace whistleblowing procedures and the status of whistleblowers per se, especially when it comes to the private sector. 

While public officials and individuals benefit from a certain degree of protection inherent to the Protocol for the Protection of Corruption Whistleblowers as well as the General Law on Administrative Responsibility in a more general way, employees from the private sector do not benefit from any similar regulations on workplace whistleblowing. So far, the effort to regulate whistleblowing in Mexico has mainly been focused on corruption acts carried out by public officials themselves, rather than any type of potential violation carried out by any individual or entity. 

Therefore, in Mexico’s private sector, one must seek the corresponding rules and protection from other statutes, such as the Constitution, the Federal Labor Law, anti-discrimination legislation, data privacy regulations, criminal regulations, or even international standards. 

Apart from the exceptions mentioned below, there is no obligation for any company to implement a whistleblowing procedure. The closest obligation is outlined in the NOM-035-STPS-2018 (also known as “Official Mexican Standard”, which are norms aimed at regulating health and safety in the workplace), which establishes the obligation for companies to create a safe and confidential complaint mechanism allowing employees to report any act of workplace violence or acts that go against a “favourable work environment”. 

Per recent reforms, companies operating digital platforms (eg, Uber, DiDi and Rappi) are now expressly required under the Federal Labour Law to establish specific mechanisms for handling complaints and reports concerning workplace violence, harassment, sexual harassment and discrimination. In addition, legal entities participating in public procurement must include whistleblowing tools and whistleblower protection in their integrity programs. 

Since there is no specific regulation in Mexico on whistleblowing procedures, companies may implement complaint mechanisms as they deem appropriate, provided these are safe and confidential, in accordance with the NOM-035-STPS-2018.

As mentioned in previous questions, the only sanction that could be imposed on companies would be related to lack of compliance with the provisions of the NOM-035-STPS-2018, which sets forth a fine ranging, in 2026, from approximately 28,000 – 570,000 MXN.

Given the lack of regulation on workplace whistleblowing, there is no specific requirement applicable to the implementation of complaint or report systems.

Having said the above, it is important to note that the Federal Labour Law establishes the obligation for employers in Mexico to implement, in coordination with employees, a protocol to prevent discrimination based on gender and address cases of violence and sexual harassment, as well as eradicate forced and child labour. It is common practice to set out the rules surrounding the complaint mechanism in this protocol, so that, in a certain way, employees must be involved in the implementation (or at least, a couple of employee representatives). 

However, the Federal Labour Law is extremely vague as to what is meant by “in coordination with employees”. In practice, companies usually outline the complaint mechanism and present it as is to employees for its ratification within the approval of the protocol.  

The very few regulations that mention a complaint mechanism only set out the obligation for employers to make the corresponding policies (protocol, NOM-035-STPS-2018 policy) known to employees. There is, however, no mention of any particular information that must necessarily be provided to the workforce about whistleblowing procedures.

No. However, it is always recommended to adopt, at least, a dual language policy, to ensure its correct understanding from local employees, as well as minimise the administrative burden in case of trial or inspection. 

In the absence of guidelines or regulations, companies may manage the reporting channel themselves or through external providers. However, companies should always bear in mind regulations on data privacy, especially when outsourcing such services. In 2025, new versions of the General Law on Transparency, the General Law on Protection of Personal Data Held by Public Entities, and the Federal Law on Protection of Personal Data Held by Private Parties were published in the DOF, which reinforced obligations on data controller regarding security measures, data subject rights and accountability when engaging data processors. Among others, this means that the whistleblower’s identity, the reported person’s data and any information gathered during internal investigations constitute personal data subject to these rules. Companies must establish a legal basis for processing, implement adequate security measures to protect the reporters’ identity, define clear retention periods for investigation files and ensure cross-border data transfers to overseas providers comply with consent requirements or appropriate contractual safeguards under Mexican Law.

As mentioned above, the complaint or alert mechanism should always comply with a certain standard of safety and confidentiality. While the corresponding norm does not define this standard, data privacy regulations will be triggered, including protection of the whistleblower’s identity when they can be identified, as well as chain of custody integrity standard. Companies must also ensure compliance with the updated data privacy framework.

It is always recommended to outline in detail the whistleblowing procedure, including the rights and protections granted to whistleblowers, for example, preservation of their identity and rights against retaliation and discrimination.

Also, since most whistleblowing complaints usually end up in internal investigations, companies should ensure that they carry out proper investigation and sanction procedures, in line with local legislation. 

There is no limit established in Mexico, so any act or omission could be subject to a complaint, with a particular emphasis on workplace violence and corruption (when it comes to the private sector). 

In the public sector, the only formal whistleblowing mechanism that currently exists and is regulated in Mexico, consists of the channel created by the Public Administration Ministry: the Internal and External Citizen Corruption Whistleblower System (Sistema de Ciudadanos Alertadores Internos y Externos de la Corrupción). Such a system allows any citizen to report any information about acts that have been committed, are being committed, or are likely to be committed by public servants regarding alleged serious acts of corruption, human rights violations, harassment, and sexual harassment. However, as one may note, this system is exclusively dedicated to reporting public officials’ acts and omissions.

The only regulation that has been implemented for a specific sector is inherent to public officials and public administration generally, which is regulated by diverse protocols and laws – both regarding the obligation to report and whistleblowers’ rights. 

The answer to this question is not straightforward. 

In theory, any individual could make a whistleblowing report at any time, through the channels created by the Public Administration Ministry, including through the Internal and External Citizen Corruption Whistleblower System. However, as mentioned previously, only reports on public officials will be accepted. 

When it comes to the private sector, the answer is a bit more intricate, because of the lack of specific regulation on whistleblowing, doubled with the legislation applicable to confidentiality, data privacy and defamation, balanced with the obligation established in the National Code of Criminal Procedure to report any act that may constitute a crime that has been committed.

In such respect, one could consider that an external whistleblowing report is always an available option (ie, using the Internal and External Citizen Corruption Whistleblower System, reporting a crime to the authority, making an anonymous complaint to the Ministry of Labour, Tax Administration, or even using company-sponsored complaint mechanism). Making a public disclosure could prove trickier in Mexico, as a consequence of the confidentiality obligations that are triggered, especially when it comes to the private sector.

There is no general definition of whistleblower in Mexico. The closest definition can be found in the Guidelines for the Promotion and Operation of the Internal and External Citizen Corruption Whistleblower System, which establishes the following: ‘The whistleblower provides information on acts that have been committed, are being committed or are likely to be committed by public servants regarding alleged serious acts of corruption, human rights violations, harassment, and sexual harassment’.

Anyone.

No.

Yes.

There is no regulation on this point.

The few regulations that mention whistleblowing or complaint procedures include general requirements that can be summed up as follows: a secure communication mechanism that guarantees the anonymity of the whistleblower and the security of the information.

Usually, confidentiality applies to the whistleblowers’ identity, who have the right to remain anonymous if they wish. Other confidentiality obligations may be observed, for example, those established in the Federal Labour Law regarding industrial or trade secrets, confidential information, or those established in data privacy regulations. 

No.

In accordance with the National Code of Criminal Procedure, any person has the obligation to report any act that may constitute a crime that has been committed to the Public Prosecutor’s Office or, in case of emergency, to any police officer. Other specific regulations may apply on the obligation to report depending on the industry to which a company belongs, or if any international regulation applies to the same. 

No. There is an express prohibition not to discriminate or to retaliate.

The Federal Labour Law does not establish any sanction applicable to employers as a consequence of the obstruction of a whistleblower. However, there may be sanctions imposable to the employer if it can be demonstrated that the employer knew about, or was informed about, a risk for the workplace, for example, a situation of sexual harassment, and did not take any action. 

In the private sector, there is no regulation on whistleblowers’ rights and obligations, including protection measures. The only general rule that applies is that retaliation and discrimination are prohibited – this protection being an intrinsic right of any individual, so that no specific procedure must be followed to benefit from the same. 

When it comes to the public sector, when an individual files a report in the Internal and External Citizen Corruption Whistleblower System, they may request and receive the necessary protection measures to prevent retaliation against them, their family, their integrity, assets and property (ie, medical and psychological attention, immunity from sanction and retaliation, legal assistance).

Private employees whistleblowers within a company are usually individually protected (ie, against discrimination, retaliation). Any individual who is a whistleblower against public officials may be protected individually, but may also benefit from protection towards their family, assets and properties when requested. 

Since there is no specific regulation inherent to whistleblowers in the private sector in Mexico, there are no requirements and thus no specific sanction inherent to a breach of the same. 

Yes. Usually, the sanction consists of fines that could be imposed based on data privacy regulations, among others. 

The protocols implemented in the public sector establish that the principle of good faith will govern the whistleblowing procedures, so that the public servants who intervene must guarantee and protect the exercise of rights of the whistleblower and they must not criminalise or hold whistleblowers responsible for their situation and must provide them with the necessary attention and assistance within the framework of their powers.

However, such exemption is not foreseen in any other legislation of a higher rank (ie, criminal) or in the private sector. 

Formal support measures are only available when it comes to reports made against public officials through the platforms made available by the Public Administration Ministry. It may range from safety measures to protection against labour termination, among others. 

When it comes to internal whistleblowers in the private sector, the definition of the support measures available to them is left at the discretion of the employer, as a consequence of the lack of regulation. 

From a labour standpoint, if the company can prove the falseness of the report and the bad faith of the whistleblower, a cause for termination could theoretically be invoked, based on lack of probity and honesty. However, terminations for cause in Mexico are usually intricate and often result in a labour trial, in which the company will have the burden of proving that the employee indeed incurred a cause for termination (and in this case, undoubtfully evidencing ‘bad faith’ can prove tricky).