Mexico event legal requirements: build three separate evidence packets

Start with location, provider and evidence boundaries

Record the legal organizer/provider, operator, exact venue address, state, municipio or CDMX alcaldía, date, audience, configuration and activities. Describe any food area or installation outside the venue. A venue document may cover a particular establishment or configuration without answering every question about your proposed event.

Keep each packet’s state explicit: unknown, submitted, received, or an applicable authorization with its scope checked. A received document is not automatically an approval. Do not assume silence grants permission, and record which changed fact requires another answer.

Packet 1: confirm the precise local route

The official Iztapalapa page in Ciudad de México distinguishes autorización, aviso and permiso routes. It illustrates why location and activity matter; it does not establish a national document bundle. The page contains legacy wording, and current local rules, complete documents, fees, deadlines, thresholds and silence provisions were not verified for this guide.[3]

Use that page only as a routing starting point if relevant to your location. Ask the competent current office which modality applies to the specific venue, operator and event footprint. Obtain the current form, legal basis, conditions and supporting-document requirements rather than copy the page’s figures. Elsewhere in Mexico, identify the appropriate local route independently.

Packet 2: align the offer with the customer’s actual terms

Within the consumer-transaction scope of the Ley Federal de Protección al Consumidor, Article 7 addresses disclosure and respect of offered or agreed conditions. Article 7 Bis requires a conspicuous total payable including applicable taxes, commissions and other required costs. This is not a universal tax rate or CFDI conclusion for every organizer.[1]

For applicable electronic consumer transactions, Article 76 Bis I–VII includes confidentiality/security and advance contact, physical-address, terms, costs and payment-information duties. Keep the actual provider, event, restrictions and clarification or complaint route identifiable. The recurring-charge/subscription provisions in VIII–IX do not establish a universal ticket cancellation or refund right; this guide does not decide those entitlements.[1]

The retrieved LFPC text identifies a December 12, 2025 reform and a separate December 23, 2025 amounts/fines update. These are distinct dates, not a single reform date. Check intervening changes before publication or action, and retain the version of the public offer and terms that the customer actually saw.[1]

Packet 3: map private-sector data to purposes and notice

The retrieved Ley Federal de Protección de Datos Personales en Posesión de los Particulares is the new law published March 20, 2025, with a November 14, 2025 reform. It names Secretaría Anticorrupción y Buen Gobierno; do not route current questions through an assumed old INAI authority or use the 2010 law as the current basis. No current authority complaint endpoint was verified here.[2]

Within this private-sector law’s scope, Articles 12 and 14–16 support purpose-proportional collection and an applicable privacy notice. Identify the actual controller and address, data and any sensitive categories, purposes, options to limit use, ARCO rights procedure—access, rectification, cancellation and opposition—and the notice-change route. Electronic collection has specified simplified and full-notice delivery treatment, not merely a footer link.[2]

Articles 7–9 make consent and exceptions fact-dependent: express or tacit consent is not interchangeable in every case. Sensitive personal data generally requires express written consent, subject to applicable statutory exceptions. Do not prescribe one checkbox for every field or a fixed retention period. Avoid routine health-detail collection; obtain qualified review of the data category, purpose, vendors, safeguards and applicable consent or exception.[2]

A blank three-packet worksheet

Complete this cover sheet before choosing a modality: organizer/provider and contact ____; event/date/timezone ____; exact address, state, municipio/alcaldía ____; venue operator/configuration ____; indoor/outdoor activities and public-space footprint ____; official source/version date ____. Then repeat the relevant row for each unresolved issue.

Store the source link and applicable scope alongside each document. Assign someone to reconcile conflicting information, not just collect PDFs. A policy written by the organizer cannot settle all mandatory consumer rights, and a privacy notice cannot make unnecessary collection proportionate.

Fictional Iztapalapa case: three packets, no approval

Barrio Resonance is an invented indoor community concert in Iztapalapa, CDMX, with an outside food area proposed. No permit, venue approval, capacity or compliance has been established. These are fictional work assignments, not permission to sell or hold the event.

Adding alcohol, changing a vendor or moving outdoors reopens the affected packet. End with a dated list of outstanding questions and the authority or adviser needed for each. Even a tidy, complete folder is not legal or safety certification: it makes the remaining decisions visible.