MEXICO Trends and Developments Contributed by: Daniel Villanueva Plasencia, Carlos Vela-Trevino and Paulina Bojalil Warth, Baker McKenzie
Baker McKenzie Pedregal 24, 12th floor Lomas Virreyes / Col. Molino del Rey México City, 11040 Mexico Tel: +52 55 5279 2900
Email: Adrian.Rodriguez-Montfort@bakermckenzie.com Web: www.bakermckenzie.com/en/locations/latin-america/ mexico
Executive Summary Mexico’s privacy architecture was fundamentally reshaped in 2025. A sweeping constitutional reform dissolved the autonomous data protection regulator and ushered in a new statutory framework, including a revised Federal Law for the Protection of Personal Data Held by Private Parties (“LFPDPPP 2025”, for its initials in Spanish), effective from 21 March 2025. Enforcement authority over the private sector moved to the Secretariat of Anti-Corruption and Good Gov - ernance (SABG, for its initials in Spanish), an execu - tive-branch body, while judicial review now proceeds through specialised federal courts via amparo. For businesses, the impact has been immediate: refreshed definitions, tighter consent and privacy notice mechanics, and a new enforcement and litiga - tion pathway, all unfolding during a transitional period in which implementing regulations remain pending and further revisions to the LFPDPPP 2025 may result in a new law which it is rumoured will be issued in 2026. This analysis reflects the legal and regulatory position as of February 2026. At the same time, Mexico is rolling out a biometric digital identity system ( CURP biométrica and Llave MX ), a National Cybersecurity Plan (2025–2030) and seeking real-time access to digital platforms trans - actional information, including personal data of tax - payers/users for tax audit purposes. Together, these initiatives elevate risks and compliance expectations regarding governance, security, identity proofing and electronic evidence preservation. Cross-border strat - egies should also anticipate the USMCA joint review in 2026 and Mexico’s engagement with the UN Con -
vention against Cybercrime, both of which will influ - ence data flow governance and incident response standards. Treat 2026 as a year to reset the foundations: assess, harden and document privacy and security pro - grammes now, allowing future regulatory updates to require only adjustments, rather than a full redesign. 1. Introduction Mexico’s data protection landscape has undergone a profound transformation during 2025–2026. Rather than incremental reform, change has been driven by institutional restructuring, political realignment, and an ambitious digital transformation agenda from the government. These dynamics have created a complex compliance environment in which companies must plan for uncertainty. Although the market anticipated a substantive mod - ernisation of Mexico’s privacy framework, particularly around the European General Data Protection Regu - lation (GDPR), artificial intelligence (AI), automated processing and decision-making, and algorithmic transparency, the enacted private sector law largely preserves the architecture of the 2010 regime. As a result, organisations are increasingly relying on inter - nal governance, risk-based analysis and international standards to bridge regulatory gaps while awaiting secondary legislation, new enforcement priorities from the new data protection authority and early judicial interpretation. The reforms originate in a November 2024 constitu - tional amendment that eliminated seven autonomous
321 CHAMBERS.COM
Powered by FlippingBook