MEXICO Trends and Developments Contributed by: Daniel Villanueva Plasencia, Carlos Vela-Trevino and Paulina Bojalil Warth, Baker McKenzie
agencies, including the National Institute for Trans - parency, Access to Information and Personal Data Protection (INAI), which had served as Mexico’s data protection authority. Such reform was effective in early 2025. Decrees published in the Official Gazette in March 2025 formalised a new law (LFPDPPP 2025) for the private sector and a General Law governing public sector processing of personal data, both effec - tive from 21 March 2025. As of early 2026, implementing regulations have not yet been published. SABG initiated stakeholder dia - logues in January 2026, but no revised regulations or technical corrections have appeared in the Official Gazette. No judicial precedents from the specialised courts have been reported publicly. SABG has, how - ever, signalled increased scrutiny following several high-profile cyber incidents during the end of 2025 and early 2026, suggesting that enforcement activity may resume before the regulatory framework is fully harmonised. 2. Legislative Shifts and Regulatory Redesign 2.1 The 2025 reset: new laws, new authority, new courts On 20 March 2025, Mexico enacted a package of reforms realigning its data protection framework with the dissolution of INAI. Central to this package are the new LFPDPPP (private sector) and the General Law on the Protection of Personal Data Held by Obligated Subjects (public sector) (LFPDPPSO, for its initials in Spanish), both effective the following day. Private sector oversight now resides with SABG, an executive-branch ministry. Appeals against enforce - ment decisions proceed through specialised federal courts via amparo. This institutional redesign matters in practice: enforcement culture, evidentiary expecta - tions and timelines are likely to differ from those devel - oped under INAI. During this bedding-in period, com - panies should document compliance judgments and risk-based decisions carefully, anticipating later scru - tiny by courts rather than administrative precedent. 2.2 LFPDPPP 2025: continuity over transformation The LFPDPPP 2025 preserves the core principles of the 2010 law: lawfulness, consent, information, qual - ity, purpose, loyalty, proportionality and accountability.
However, critical definitions such as “data process - ing”, “personal data” and “data controller”, which were previously aligned with international frameworks such as the GDPR, have now been altered, creating inter - pretative risks. Privacy Notices must now describe processing activities with greater precision, disclose whether sensitive personal data is being processed, and distinguish those activities which the data subject may choose to opt-in to or opt-out from before the collection of data takes place. Structurally, however, the statute remains familiar. The absence of a dedicated framework for AI governance, automated decision-making or algorithmic transpar - ency is widely viewed as a missed opportunity. Until secondary regulation or future legislative amendments address these areas, organisations must rely on inter - nal controls and risk assessments following a data protection impact assessment methodology, together with international benchmarks to manage exposure. 2.3 Key definitional and structural updates Updated definitions emphasise the breadth of “per - sonal data” and recalibrate consent standards towards specificity and revocability. Privacy notices must be clearer and more granular, identifying cat - egories of data and linking them to defined purposes. These changes heighten supply-chain accountability and reinforce the need for auditable data-processing agreements. 2.4 Consent, notices, transfers and supply-chain accountability Consent under the new statute must be free, specific and informed, with diminished tolerance for bundling multiple purposes under broad compatibility theo - ries. When purposes change materially, fresh consent should be obtained. Privacy notices must distinguish which purposes require consent and clearly identify sensitive data. Although the statute no longer mandates a standalone section relating to transfers in comprehensive notices, transfer obligations themselves remain intact. Organi - sations should design separate, standardised transfer workflows and obtain consent where required. The definition of publicly accessible sources has been nar -
322 CHAMBERS.COM
Powered by FlippingBook