MEXICO Trends and Developments Contributed by: Daniel Villanueva Plasencia, Carlos Vela-Trevino and Paulina Bojalil Warth, Baker McKenzie
rowed to those explicitly authorised by law, excluding datasets obtained through informal or unlawful means. Administrative fines can reach up to 320,000 UMAs (approximately MXN40 million), with enhanced penal - ties for sensitive data and repeat violations. Appeals against SABG resolutions proceed through amparo, reinforcing the need for precise lawful-basis mapping, consent records and decision logs. 2.5 Implementing regulations and transitional risk The legislative package contemplated harmonised regulations following enactment. In practice, most organisations continue to rely on the 2011 Regula - tions and legacy guidance, interpreting references to the former authority as applying to SABG. As of February 2026, no updated regulations or tech - nical corrections have been published. Market specu - lation persists that additional legislative amendments could precede finalised regulations, potentially render - ing draft rules obsolete. In this environment, conserva - tive compliance strategies are prudent: overdisclosure in notices, disciplined purpose limitation, low-friction re-consent mechanisms, and meticulous documenta - tion of interpretative choices. 2.6 Institutional transition: from INAI to SABG The shift from an autonomous regulator to an execu - tive-branch authority marks a structural pivot. During this transition, enforcement activity slowed and offi - cial guidance became limited, prompting consumer protection agencies, financial regulators and other sector-specific authorities to step in and fill the gaps. Given her record of strict oversight of tax regulation while serving at the tax authority, the new head of SAGB was widely expected to take an equally firm approach to data protection enforcement. Her back - ground suggested that SABG would not hesitate to pursue significant actions against major companies, including technology operators. Early enforcement actions that occurred in January 2026 following several highly publicised cyber inci - dents affecting Mexican governmental and private organisations and data subjects already illustrate this shift, with authorities initiating formal proceed -
ings immediately and making them public from the outset. This represents a sharp departure from prior INAI practices, where preliminary review stages often allowed early clarification or resolution before escala - tion. The new approach indicates a greater willingness to pair legal processes with public communication to enhance deterrence. At the same time, growing calls for stronger sanctions indicate that enforcement will intensify as broader legislative reforms move forward. While no public sanctions or judicial decisions have been issued as of early 2026, early probes suggest heightened scrutiny of data controllers and proces - sors’ conduct and incident handling. Companies should prepare for uneven enforcement criteria and prioritise defensible governance, DPIA-style analysis for high-risk processing (such as AI and biometrics), and investigation-ready documentation. 3. Cybersecurity: Strategy Ahead of Statute Mexico still lacks a single comprehensive cyberse - curity statute. Obligations remain distributed across criminal law, data protection rules and sectoral regu - lation. In late 2025, however, the federal government presented a National Cybersecurity Plan (2025–2030) and a General Cybersecurity Policy for the federal administration. These instruments signal a more co-ordinated approach to cyber risk, including centralisation of CSIRTs/CERTs, phased adoption of AI-driven defenc - es and enhanced co-operation on incident response. Mexico remains highly exposed to ransomware, with over 150 publicly reported victims since 2019. For companies, governance is the priority: integrate cyber risk into enterprise risk management, align inci - dent response with electronic-evidence preservation, maintain 24/7 law-enforcement contact protocols and conduct regular tabletop exercises. Sectoral alignment is emerging, particularly in financial services and critical infrastructure, where supervisory expectations already include breach reporting and resilience testing.
323 CHAMBERS.COM
Powered by FlippingBook