Cybersecurity and GRC terminology: English to Mexican Spanish
Use this guide when translating cybersecurity, privacy, audit, and GRC content for professionals in Mexico. It describes professional usage, not word-for-word equivalence.
Edition 2026.3. The companion guide, Spanish to English, lives on the Spanish version of this page. If something here is not how you would say it, tell us.
Legal note: Legal terms are date-sensitive, and this guide is not legal advice. Verify the current official instrument, authority, and procedure before relying on a legal translation.
How to use this guide
The default register is formal Mexican professional writing: security policies, audit reports, regulatory material, technical documentation, and professional training. Team chat, job titles, product names, commands, and quoted interface text may retain more English.
- Translate: Mexican professional writing normally uses the Spanish term.
- Keep in English: The English borrowing is the normal specialist term in Mexico.
- Context-dependent: The correct form changes with technical sense, register, organization, or jurisdiction.
- Official name or acronym: Preserve the official name, designation, or working acronym.
- Legal term, date-sensitive: Use the wording of the governing instrument and verify the current official text.
Consistency applies to the same sense, register, jurisdiction, and grammatical use. It does not require different concepts to share one translation.
Terms
data breach
→vulneración de seguridad; vulneración de seguridad de datos personales; brecha de datosLegal term, date-sensitivePrivacy law and nonstatutory cyber writing
Vulneración de seguridad is the exact term of the current LFPDPPP (DOF, March 20, 2025). It appears there twice (vulneración a la seguridad appears zero times in that law) and the operative use is article 19 (las vulneraciones de seguridad ocurridas en cualquier fase del tratamiento). The LGPDPPSO uses both vulneración de seguridad and vulneración a la seguridad, with the breach taxonomy at articles 31 to 35. When citing law, preserve the instrument's exact wording. The longer vulneración de seguridad de datos personales appears in neither current statute; it derives from the 2011 Regulation, still officially listed as current, and remains a safe descriptive umbrella outside direct statutory citation. Brecha de datos is clear nonstatutory professional language; brecha de seguridad appears zero times in either law. Do not import another jurisdiction's notification rule.
Example: The controller documented the personal data breach. → El responsable documentó la vulneración de seguridad de datos personales.
Sources: Official DOF publication of March 20, 2025 (LFPDPPP and LGPDPPSO) · Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current
That is not how I would say it
LFPDPPP
→LFPDPPP; Ley Federal de Protección de Datos Personales en Posesión de los ParticularesLegal term, date-sensitiveMexican private-sector privacy law
The acronym remains current. A new law with the same title was published on March 20, 2025; it took effect on March 21 and abrogated the 2010 enactment. Cite the current consolidated law for current matters. Use the 2010 text for historical facts or transition-governed proceedings. INAI is no longer the current authority, but its historical acts remain relevant. The current law defines the Secretaría Anticorrupción y Buen Gobierno as la Secretaría.
Sources: Current LFPDPPP, Chamber of Deputies
That is not how I would say it
LGPDPPSO
→LGPDPPSO; Ley General de Protección de Datos Personales en Posesión de Sujetos ObligadosLegal term, date-sensitiveMexican public-sector privacy law
Preserve the official title and acronym. A new law with the same title was published on March 20, 2025, replacing the 2017 enactment. It allocates authority between the Secretaría and the applicable Autoridad garante, depending on the subject and jurisdiction.
Sources: Current LGPDPPSO, Chamber of Deputies
That is not how I would say it
personal data
→datos personalesLegal term, date-sensitiveMexican privacy law
Datos personales is the current Mexican statutory term. It is not automatically coextensive with every US framework's definition of PII.
Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies
That is not how I would say it
personal-data processing
→tratamiento de datos personalesLegal term, date-sensitivePrivacy law
Use the statutory umbrella tratamiento de datos personales for operations performed on personal data. Do not narrow the defined legal concept to the more ordinary manejo de datos.
Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies
That is not how I would say it
personal-data transfer
→transferencia de datos personalesLegal term, date-sensitivePrivacy law
Use transferencia de datos personales for a communication to a recipient other than the data subject, controller, or processor, subject to the governing instrument. Do not use it for the separately defined controller-to-processor remisión.
Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current
That is not how I would say it
PII
→PII; información de identificación personalContext-dependentUS frameworks and cross-jurisdiction privacy work
When PII is a named US or NIST construct, retain PII and, if needed, explain it as información de identificación personal. Do not silently replace it with Mexican datos personales; the scopes are not automatically identical.
Sources: NIST CSRC glossary entry for PII · Current LFPDPPP, Chamber of Deputies