MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
• Impact assessment: Evaluate the main aspects of the incident and its legal implications for rights and obligations. • Notification to affected individuals where war - ranted: Where the breach significantly affects data subjects’ property or moral rights, the controller must notify the affected individuals so they can take protective steps. Notifications should be made without undue delay and in clear, accessible terms. • Post-incident assessment: Determine and imple - ment corrective actions and improvements to avoid future occurrences with the same characteristics. 1.7 Regulators The 2024 constitutional reform provided for the dis - solution of the National Institute for Transparency, Access to Information and Personal Data Protection ( Instituto Nacional de Transparencia, Acceso a la Infor- mación y Protección de Datos Personales , or INAI) and the redistribution of its personal data protection mandates among various public bodies according to the type of entity being regulated. These changes took effect in 2025 upon the entry into force of new legislation. For organisations, the most significant consequence is that the Ministry for Anti-Corruption and Good Gov - ernment ( Secretaría de Anticorrupción y Buen Gobi- erno , or SABG) now serves as the primary regulator of the private sector. Furthermore, functions previously exercised by the INAI in the public sector were reassigned to diverse government entities, in some cases at the constitu - tional level. The National Electoral Institute ( Instituto Nacional Electoral ), for example, now oversees the processing of personal data by political parties. From an enforcement perspective, matters under the Mexican data protection framework arise from data subject complaints, security incidents, or other events that put a processing practice in question; referrals or findings generated by the public sector; and ex officio initiatives in which the competent authority opens a file on its own motion. Co-ordination within Mexico is further shaped by the post-INAI allocation of man - dates described above. Cross-border engagement is not organised around a “one-stop shop” model and
may instead be handled on a case-by-case basis when international elements are present (for exam - ple, cross-border transfers, foreign vendors or multi - national group processing). As mentioned in 1.1 Overview of Data and Privacy- Related Laws , the guidelines, criteria and recom - mendations issued by the competent authorities typically operate as interpretative tools and enforce - ment benchmarks. Even where such guidance is not formally binding in the same manner as legislation, it often carries significant practical weight in audits, verification procedures and the authorities’ assess - ment of compliance. 1.8 Enforcement Proceedings and Fines Enforcement by the SABG is typically structured as a step-by-step administrative workflow. In prac - tice, the first operational step for a data controller is usually receiving a formal request for information and documentation from the authority. The authority then reviews the response and may issue follow-up requests to address inconsistencies or obtain fur - ther evidence. Regardless, companies are subject to three main tracks: (i) the rights-protection procedure (focused on ARCO Rights disputes); (ii) the verification procedure (fact-finding and compliance review); and (iii) the sanctioning procedure (imposition of penalties). Although these tracks may be connected in practice, each follows its own sequence of procedural acts and statutory timeframes. Decisions issued by the SABG may be challenged through judicial remedies. Specifically, affected par - ties may seek constitutional relief (amparo) against acts and resolutions of the SABG. Rights-Protection Procedure If the SABG receives and admits a rights-protection request from any data subject, the SABG serves it on the controller and requests a response with support - ing evidence. The file then moves through an eviden - tiary phase, followed by final allegations, and ends with a binding decision. As a useful rule of thumb, the authority’s decision is issued within 50 days, with the possibility of an extension for justified cause. Where the decision favours the data subject, the controller
314 CHAMBERS.COM
Powered by FlippingBook