Cybersecurity and GRC terminology: English to Mexican Spanish
Use this guide when translating cybersecurity, privacy, audit, and GRC content for professionals in Mexico. It describes professional usage, not word-for-word equivalence.
Edition 2026.3. The companion guide, Spanish to English, lives on the Spanish version of this page. If something here is not how you would say it, tell us.
Legal note: Legal terms are date-sensitive, and this guide is not legal advice. Verify the current official instrument, authority, and procedure before relying on a legal translation.
How to use this guide
The default register is formal Mexican professional writing: security policies, audit reports, regulatory material, technical documentation, and professional training. Team chat, job titles, product names, commands, and quoted interface text may retain more English.
- Translate: Mexican professional writing normally uses the Spanish term.
- Keep in English: The English borrowing is the normal specialist term in Mexico.
- Context-dependent: The correct form changes with technical sense, register, organization, or jurisdiction.
- Official name or acronym: Preserve the official name, designation, or working acronym.
- Legal term, date-sensitive: Use the wording of the governing instrument and verify the current official text.
Consistency applies to the same sense, register, jurisdiction, and grammatical use. It does not require different concepts to share one translation.
Terms
data subject
→persona titular; titularLegal term, date-sensitivePrivacy law
Use persona titular or titular for Mexican privacy law. Interesado is usual EU GDPR terminology and may mean an interested party or applicant in Mexican legal prose. Sujeto de datos is a literal calque, not the Mexican statutory term.
Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies
That is not how I would say it
data subject (EU GDPR)
→interesadoLegal term, date-sensitiveEU privacy law in Spanish
Use interesado for the EU GDPR role. In Mexican legal or administrative prose, bare interesado may instead mean an interested party or applicant; current Mexican privacy statutes use persona titular or titular.
Sources: Official Spanish text of the EU GDPR · Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies
That is not how I would say it
personal-data transfer
→transferencia de datos personalesLegal term, date-sensitivePrivacy law
Use transferencia de datos personales for a communication to a recipient other than the data subject, controller, or processor, subject to the governing instrument. Do not use it for the separately defined controller-to-processor remisión.
Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current