ARCO refers to access, rectification, cancellation and opposition rights in Mexican data-protection law. These are tools for addressing a responsible organization's handling of personal data. They are not interchangeable with a Google removal request or a promise to delete every mention of a person online.
01
Choose the result you actually need
Access concerns understanding the personal data held about you. Rectification addresses inaccurate, incomplete or outdated information. Cancellation and opposition concern stopping or limiting particular handling under the applicable rules, with conditions and exceptions.
For example, an incorrect address in a company's customer record presents a different task from an accurate historical news article. Explain the specific record and desired correction rather than asking every recipient to erase your identity generally.
02
Identify the responsible organization
Review the organization's privacy notice and designated data-rights contact. Mexico's law for private-sector controllers is distinct from the public-sector framework. Confirm which setting applies before reusing a form or assuming the same authority and procedure govern both.
Use a verified channel for identity documents and avoid sending more unrelated information than the process requires. If acting for someone else, establish appropriate representation.
- Identify yourself through the official process.
- State the right or practical outcome you seek.
- Describe the relevant data clearly.
- Provide supporting records for a factual correction.
- Keep the submission, acknowledgment and response together.
03
Assess the response rather than promising deletion
The current private-sector law recognizes exceptions to cancellation and circumstances in which requests may be denied or only partly fulfilled. Review the stated reason and the actual changes made. A refusal is not automatically proof that no rights exist, but it may require a different remedy or qualified advice.
Track applicable deadlines using the current law and the specific process. Related terms used in European privacy law do not automatically extend or replace Mexico's ARCO framework. Cross-border cases should identify the controller and legal basis before making demands.
Frequently asked questions
Does ARCO automatically remove Google results?
No. A request to a data controller and a search-engine removal process address different actions and must be assessed separately.
Can I use the same request for every organization?
A basic record helps, but tailor the recipient, data, requested action and applicable framework to each case.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.