MEXICO Trends and Developments Contributed by: Daniel Villanueva Plasencia, Carlos Vela-Trevino and Paulina Bojalil Warth, Baker McKenzie
cookie banners and preference centres should align with purpose specificity and retention transparency. 8.3 Health and life sciences Sensitive data handling and identity flows demand heightened risk assessment, particularly in telemedi - cine and employee benefits programmes. Clinical and HR governance should be co-ordinated to align access controls, logging and retention with sensitivity and risk. 9. Governance, Rights and Civil Liberties Centralised digital identity and executive-branch oversight of privacy have prompted a sustained civil- liberties debate. For companies, the most sustainable position is technical neutrality anchored in privacy by design: collect only what is necessary, document pro - portionality, encrypt thoroughly and enable meaning - ful user controls. Data-subject rights (known as ARCO rights) remain formally intact, but procedural expectations may tighten under SABG, particularly in regard to identity verification and response documentation. Automated decision-making remains largely unregulated, increas - ing the importance of internal safeguards, human-in- the-loop processes, explainability documentation and risk assessments, especially in credit, insurance, employment and mobility contexts. 10. What to Watch For Key developments to monitor include publication of harmonised LFPDPPP regulations, potential technical corrections to statutory text, and early enforcement signals from SABG. The first judicial decisions from specialised courts will shape practical boundaries regarding consent, notices and accountability.
Digital platforms should begin developing cyberse - curity and technical governance standards that allow companies to provide controlled and secure access to their information when required by tax authorities. At the same time, organisations should expect the electronic CURP to become the default mechanism for identifying employees and customers across a wide range of sectors, as Mexico continues to imple - ment biometric-based identity verification. In paral - lel, companies should anticipate a growing volume of information requests from police and investigative authorities, who, under several of the 2025 reforms, may increasingly rely on corporate datasets for real- time or near-real-time investigative purposes. Internationally, Mexico’s ratification and implementa - tion of the UN Convention against Cybercrime and the outcomes of the USMCA 2026 review will influence electronic-evidence standards, cross-border data governance and AI-related expectations. Organisa - tions that track these developments and maintain disciplined, well-documented governance will be well positioned to adapt incrementally rather than rebuild wholesale. Mexico’s 2025–2026 privacy and cybersecurity envi - ronment is dynamic but navigable. Anchor compli - ance with the new statutory text, interpret consent and notice requirements conservatively, and pre-wire security and incident response programmes for cross- border evidence co-operation. Treat 2026 as a reset year: tighten controls now so future regulatory clarity is a matter of evolution rather than revolution.
326 CHAMBERS.COM
Powered by FlippingBook