Latin America
Student accommodation regulation in Mexico (2026)
Mexico has no federal act that regulates student residences as an activity. Anyone opening or running one has to put three pieces together: the civil code of the state where the building stands, which separates a lease from a lodging agreement; civil protection rules and local licences for the building; and the 2025 Federal Law on the Protection of Personal Data Held by Private Parties, enforced by the Secretaría Anticorrupción y Buen Gobierno.
The short answer
Mexico has no student accommodation act: the catalogue of federal laws in force lists none, and no artificial intelligence act either (checked on 19 October 2026).
| What | Rule | Who applies it |
|---|---|---|
| Legal figure | No act of its own: lease or lodging agreement (Federal Civil Code, Arts. 2398 and 2666) | Civil judges |
| Contract | Each state's civil code; in the capital, the Civil Code for the Federal District | Local civil courts |
| Building | General Law on Civil Protection, Arts. 39 and 40; municipal licences | Civil protection and municipalities |
| Data | Federal Law on the Protection of Personal Data Held by Private Parties | Secretaría Anticorrupción y Buen Gobierno |
| AI | No federal act; objection to automated processing (data protection law, Art. 26) | Secretaría Anticorrupción y Buen Gobierno |
What residences are called there
There are university residences, private residences let room by room —what is called PBSA elsewhere— and casas de huéspedes or casas de asistencia (boarding houses), where a room is rented with meals. None is a legal figure: the law looks at the contract, and the Federal Civil Code offers two.
- Arrendamiento (lease, Art. 2398): one party grants the temporary use of a thing and the other pays a certain price for it. It fits the student residence that only provides the room.
- Hospedaje (lodging agreement, Art. 2666): accommodation is provided for the agreed payment, "comprendiéndose o no, según se estipule, los alimentos y demás gastos que origine el hospedaje" ("with or without, as agreed, the meals and other expenses the lodging gives rise to"). It fits the residence with a dining hall and services.
A nuance: the Federal Civil Code governs "in matters of the federal order" (Art. 1). The contract with a student is governed by the civil code of the state where the building is.
The contract: lease or lodging
In Mexico City the Civil Code for the Federal District applies (text in force, with amendments up to 20 August 2026), and its rules for residential leases are a matter of public order and cannot be waived (Art. 2448):
- Term: a lease of a dwelling "no podrá ser menor a un año" ("may not be shorter than one year", Art. 2398); that year is binding and a tenant who is up to date can extend it by one more, "salvo convenio en contrario" ("unless otherwise agreed", Art. 2448 C).
- Rent: a single increase a year, never above the previous year's inflation (Art. 2448 D, amended on 28 August 2024).
- Deposit: one month's rent at most (Art. 2448 E).
- Registration: the contract is made in writing and the landlord enters it in the Mexico City Government's digital register within 30 days (Art. 2448 F).
If it is hospedaje, the agreed terms apply or, if it is tacit, the authority's regulation, which the establishment keeps on display (Arts. 2667 and 2668, identical in both codes).
The building
There is no federal licence to open a residence. What is national is the General Law on Civil Protection: the buildings of the companies listed in its Regulation must have an Internal Civil Protection Programme (Programa Interno de Protección Civil, Art. 40), which in each building mitigates the risks identified and prepares the response to an emergency (Art. 39).
Land use and the building and operating permits are granted by each municipality or borough. The civil code adds a floor: no premises may be let without the hygiene and health conditions to live in them (in the capital, Art. 2448 A).
Data protection
On 20 March 2025 the Diario Oficial de la Federación (Official Journal) published a new Federal Law on the Protection of Personal Data Held by Private Parties, in force from the following day, which repealed the 2010 law (first and second transitional provisions). The INAI is no longer the authority: for private parties it is the Secretaría Anticorrupción y Buen Gobierno (Arts. 2(XV), 38 and 39). For a residence that answers on WhatsApp:
- Aviso de privacidad (privacy notice) —in Spain, the GDPR information to the data subject—: controller, data and which of it is sensitive, purposes, how to exercise the ARCO rights (access, rectification, cancellation and objection) and how changes are announced (Art. 15). On a chat, the simplified version with the location of the full notice is enough (Art. 16).
- Consent: tacit consent is valid (Art. 7) and it is not needed to perform the legal relationship with the resident (Art. 9(IV)). But health is sensitive data (Art. 2(VI)): an allergy mentioned on WhatsApp calls for express written consent, with a signature or an authentication mechanism (Art. 8).
- Processors: what is communicated to the persona encargada (processor) handling the data on the residence's behalf is not a transfer (Art. 2(XX)); transfers to third parties follow the privacy notice and Art. 36.
- Automated decisions: the resident can object to automated processing, without human intervention, that significantly affects their interests (Art. 26(II)).
What the rules do not say
Worth knowing
No rule says whether a residence is a lease or a lodging agreement: what is agreed and what is provided decides it. And it matters, because the one-year minimum, the deposit cap and the capital's digital register are rules of residential leasing. A ten-month contract for the academic year clashes with Art. 2398 of the capital's code if it is classed as a lease: it should be reviewed with a lawyer from that state before signing.
Nor does the data protection law copy the GDPR: it does not speak of legitimate interest or of countries with an adequate level. And there is no AI act and no general duty to run a reporting channel for residents.
Where Bedel comes in
Bedel answers the residence's WhatsApp in the language of whoever writes (languages) and puts on the phone of someone on the team whatever a machine should not decide (escalation to people). Its data is stored in the European Union, in Ireland, and the AI model runs in the United States under the Standard Contractual Clauses. In the terms of Mexican law it would be the persona encargada (processor, Art. 2(XII)), and the residence the controller. What changes in the contract and in the processing is discussed before signing.
Frequently asked questions
Is there a student accommodation act in Mexico?
No. The catalogue of federal laws in force kept by the Chamber of Deputies has none, and a residence is not a legal figure. What is regulated is the contract: a lease, if the use of the room is granted for rent, or a lodging agreement, if accommodation is provided with or without meals. Both are in each state's civil code; the Federal Civil Code only governs matters of the federal order.
Can I sign contracts for the academic year, ten months long?
It depends on how the contract is classed and on the state. If it is a residential lease in Mexico City, Article 2398 of its code says it may not be shorter than one year, and Article 2448 C makes that year binding on both parties, unless otherwise agreed. Lodging has no such minimum. Before settling the contract template, it is worth reviewing it with a lawyer from the state where the building is.
What must a residence's privacy notice include?
At a minimum, under Article 15 of the 2025 law: the residence's identity and address, which data it processes and which of it is sensitive, what it uses the data for, how the resident can limit its use, how to exercise the rights of access, rectification, cancellation and objection, and how changes will be announced. If the data arrives by electronic means, a simplified version is given that says where to read the full notice.
Who supervises data protection now that the INAI is gone?
For private parties, the Secretaría Anticorrupción y Buen Gobierno. The law published on 20 March 2025 names it as the authority (Article 2, section XV) and gives it supervision, verification, the rights protection procedures and sanctions (Articles 38 and 39). References to the INAI in other rules are read as made to whoever took over its functions, under the fourth transitional provision of the decree.
Can I store residents' data outside Mexico?
The law does not require the destination country to offer an adequate level of protection. If the recipient is a processor handling the data on the residence's behalf, the law does not treat it as a transfer (Article 2, section XX). If it is a third party, the transfer follows the privacy notice and needs consent except in the cases of Article 36, such as one required by a contract entered into in the resident's interest.
Other countries
- ColombiaNo act of its own: an urban residential lease or the contrato de pensión of Law 820, commercial lodging, and habeas data under Law 1581 and the SIC.
- ChileNo act of its own: a lease or a lodging agreement, the OGUC's "hogar estudiantil" and a data protection law that changes on 1 December 2026.
- ArgentinaNo national act of its own: the Civil and Commercial Code lease after Decree 70/2023, each municipality's licence, and Law 25.326 with the AAIP.
- PeruNo act of its own: a lease or a lodging agreement under the Civil Code, a municipal licence with a safety inspection, Law 29733 with a new regulation and an AI regulation in force since 2026.
- SpainThe starting point in Spain: which rule governs the legal figure, the contract, the building, the data and the AI of a student residence, with the guide for each.
- United KingdomFour systems in one country: in England, membership of an approved management code weighs on whether a student building is an HMO and on which contract is signed; data follows UK GDPR.
- IrelandA figure of its own: student specific accommodation, within tenancy law and under the RTB since 2019, whether signed as a lease or as a licence.
- PortugalRules of its own for the building since January 2022 (Decree-Law 14/2022 and Ordinance 35-A/2022); the contract is a Civil Code tenancy and data goes through the GDPR and Law 58/2019.