What happens to customer data when a lender uses AI agents?

Which law applies, and who enforces it?

Mexico’s federal law on personal data held by private parties was enacted as a new law in the DOF (the official gazette) on March 20, 2025. Under its text, the enforcing authority is the Ministry of Anti-Corruption and Good Governance. The law keeps the familiar principles — lawfulness, purpose limitation, fairness and consent, among others — along with the privacy notice and the rights of access, rectification, cancellation and objection (known in Mexico as ARCO rights), which the data controller must handle within the deadlines the law sets.

The law itself carves out credit bureaus in the cases covered by their own statute. Pulling a credit report follows its own rules: article 28 of Mexico’s credit bureau law requires the customer’s express authorization.

What changes when an agent is the one handling the data?

Legally, your institution is still the controller. What changes is where you need to pay attention:

• Privacy notice. It should describe the real purposes, including the use of automated tools in servicing, collections or evaluation, where applicable.
• Processors. The vendor running the agents, and the AI services it uses, act on your institution’s behalf; that’s documented in the contract, with confidentiality and security obligations.
• Data minimization. The agent sees only the data it needs for the case at hand, never the full database.
• ARCO requests. The agent can receive a request and route it, timestamped, to the team responsible — but it doesn’t resolve it on its own.

What does the law say about automated decisions?

Article 26, section II, recognizes a right to object when personal data undergoes automated processing that produces unwanted legal effects or significantly affects a person’s interests, rights or freedoms, and is designed to evaluate certain personal aspects without human involvement — including economic situation, reliability or behavior. The law provides exceptions, for example when the processing is necessary for the controller to meet a legal obligation.

For a lender, the practical takeaway is clear: for decisions like approving or declining a loan, the prudent design has the agent prepare the analysis and a person take part in the decision. How it applies to your specific case is for your legal team to determine.

Which technical controls should the ecosystem have?

• Your institution’s data isn’t used to train models and isn’t mixed with other clients’ data.
• Role- and agent-based access, with credentials the AI model never sees.
• A log of every read and write on personal data.
• Encryption in transit and at rest, and per-client separation in the infrastructure.
• Identity verification before any data is shared with the account holder over a conversational channel.
• Defined retention periods and deletion once the purpose ends, unless another law requires keeping it (for example, customer identification records under AML rules).

InnovaBlack ecosystems are built on Claude, Anthropic’s model, and we design them with these controls from the start. More detail on our security page.

What should you check before turning an agent on?

1. That the privacy notice covers the purposes and means the agent will use.
2. That the vendor contract sets it up as a processor, with its obligations.
3. Which decisions will involve a person, and how that’s documented.
4. How the agent receives an ARCO request and who it routes it to.
5. What data each agent will see — and what it never will.

None of these slow a project down if they’re settled at the start. Every one of them stalls it if it surfaces after the agent is already talking to customers.

Short answers

Which data protection law applies to a SOFOM?

Mexico’s federal law on personal data held by private parties, in its new version published in the DOF on March 20, 2025. Under that law, the enforcing authority is the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).

Can a customer object to an agent evaluating their application?

The law recognizes a right to object when personal data undergoes automated processing that produces unwanted legal effects or significantly affects the person, and is designed to evaluate, without human involvement, aspects such as their economic situation or reliability. There are exceptions — for instance, when processing is needed to meet a legal obligation. That’s why it makes sense to keep a person involved in credit decisions.

Is my data used to train the AI?

No. In the ecosystems we build, each client’s data belongs to that client: it doesn’t train models and isn’t mixed with other institutions’ data.

Official sources

• «Ley Federal de Protección de Datos Personales en Posesión de los Particulares» (DOF, Mar 20, 2025; current text, Chamber of Deputies)
• «Ley para Regular las Sociedades de Información Crediticia» (current text, Chamber of Deputies)

This page describes rules and practices; it is not legal advice. Your compliance officer and counsel have the final word.