MEXICO Trends and Developments Contributed by: Daniel Villanueva Plasencia, Carlos Vela-Trevino and Paulina Bojalil Warth, Baker McKenzie
Separately, the UN Convention against Cybercrime, opened for signature in Hanoi in October 2025, estab - lishes a framework for harmonised cybercrime defi - nitions, 24/7 co-operation mechanisms and stand - ardised electronic-evidence preservation. Mexico has characterised the Convention as a historic step towards improved evidence sharing. Corporate inci - dent response programmes should anticipate expe - dited evidence requests and stricter chain-of-custody expectations. 7. Practical Roadmap for Doing Business in Mexico in 2026 A practical compliance roadmap should begin by determining whether a company falls within the scope of a “Diverse Institution” under Article 12 Bis of the Ley General en Materia de Desaparición Forzada de Personas , as amended in 2025, and by extension under the interconnection obligations created through the Ley General de Población , as well as whether it qualifies as a “Digital Platform” under Article 30-B of the Federal Fiscal Code. This threshold assessment will determine the breadth of compliance duties and the pace at which implementation must occur. Once within scope, organisations should begin by mapping the types of data they hold, focusing spe - cifically on transaction-level information and identity- related data that may be subject to access requests. This includes both historical and recent informa - tion that may need to be made available to different authorities operating under varying technical environ - ments and procedural rules. Any collaboration with authorities must also ensure robust traceability and auditable evidence of access. In parallel, companies should assess the maturity of their cybersecurity position against OWASP and NIST benchmarks, as required by the PUI framework. This involves aligning internal programmes with national cybersecurity expectations, assigning accountable owners, inventorying critical assets, exercising inci - dent response capabilities and integrating mecha - nisms for the preservation of electronic evidence. From there, organisations should initiate the devel - opment and deployment of the mandatory PUI end - points, together with the redesign of onboarding and
data collection processes to ensure compliant intake and management of identification data. These operational changes must be accompanied by a full refreshment of privacy notices. Notices should be concise, specific, and explicit about categories of personal and sensitive data. Any consent-dependent activities must be clearly identified, and cross-border transfers must be supported by standardised, well- documented workflows. Consent management itself requires renewed rigour, as legacy reliance on broad or “compatible” purposes is becoming increasing - ly unsustainable. If a company is using AI tools to monitor or predict employee conduct or behaviour, implementation should comply with privacy laws, and candidate and employee privacy notices should be refreshed as well. Data processors must be treated as material compli - ance risks, with contracts that reflect statutory obli - gations concerning security, sub-processing controls, breach notification standards and audit rights. Finally, companies should re-baseline their records of processing, lawful basis mapping and accountabil - ity documentation. With judicial oversight potentially weakening, investigation-ready files, such as DPIAs for high-risk processing, incident reports, vendor due diligence records, system logs and training docu - mentation, are becoming essential safeguards. This strengthened governance will be critical as organisa - tions navigate a regulatory environment in which iden - tity, security and enforcement frameworks converge. 8. Sector Notes 8.1 Financial services Institutions already face stringent supervisory expec - tations regarding breach reporting, governance and resilience testing. The national cybersecurity agenda is likely to reinforce electronic-evidence preservation and inter-institutional co-operation. Vendors should be subject to equivalent testing and drills. 8.2 Consumer and e-commerce Narrowed definitions of publicly accessible sources and refined consent mechanics require renewed scru - tiny of marketing data acquisition. Privacy notices,
325 CHAMBERS.COM
Powered by FlippingBook