Mexico

In case of any data breach, the main available legal remedy is an administrative infringement action that has to be prosecuted before the Mexican DPA (INAI).
This administrative action would only result in the imposition of any of the sanctions that we are referring to here below. However, INAI is an administrative authority not entitled for awarding damages.
It has to be mentioned that any ruling from Mexican DPA can be contested through a “nullity trial” before the Federal Court for Administrative Affairs (FCAA). The decision that this administrative court gets to issue can further be appealed through an “Amparo suit”, which is a Constitutional rights action, before the Federal Circuit Courts.
Likewise, there are some activities related to PI catalogued as felonies in the Law. In said cases individuals may file a criminal complaint with the Attorney’s General Office, which is in charge of investigating and pursuing any felonies. These criminal complaints would have to be decided by criminal courts, and may be sanctioned with imprisonment.
On the other hand, in order to collect damages, it will be necessary to prosecute a civil action before a civil court, and only until after the decision from the Mexican DPA declaring an infringement, has become final and beyond the shadow of any appeal.