On March 20th, 2025, a Decree was published in the Official Gazette establishing a new regulatory framework for the protection of personal data in Mexico. Pursuant to this Decree, the following laws entered into force: the new General Law on the Protection of Personal Data Held by Private Parties, applicable to the private sector; the new General Law on Transparency and Access to Public Information; and the new General Law on the Protection of Personal Data Held by Obligated Subjects, applicable to public authorities and entities. In addition, a new Federal Law on the Protection of Personal Data Held by Private Parties was issued, reinforcing and updating previous legal provisions in this area.
Background
These new provisions expressly repeal the Federal Law on the Protection of Personal Data Held by Private Parties published in 2010, as well as the previous versions of the General Law on Transparency and Access to Public Information and the General Law on the Protection of Personal Data Held by Obligated Subjects.
Additionally, the Decree includes the dissolution of the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI). The supervisory, oversight and regulatory functions previously exercised by the INAI will now be carried out by the Secretariat for Anti-Corruption and Good Governance, an entity under the authority of the Federal Executive Branch.
New Key Concepts
- “Personal Data” is redefined as any information that can identify an individual or legal entity, directly or indirectly. Consent must be given freely, specifically and in an informed manner.
- Consent must be given freely, specifically and in an informed manner. Its acquisition is now more flexible, including digital channels.
- The concept of “data retention period” is formalized, requiring justified durations according to purpose and clear deletion policies.
Privacy Notices
- Both Comprehensive and Simplified Privacy Notices must now specify what data is collected, sensitive data, purposes requiring consent, data usage limitations and other previously nonmandatory elements.
- Although not mandatory, it is recommended to continue disclosing data transfers to maintain trust with data subjects.
New Roles and Obligations
- The concept of Data Controller is redefined: it now includes anyone making decisions on data processing, regardless of being an individual or legal entity.
- Companies must establish internal procedures for managing the data lifecycle, including blocking and deletion measures.
Strengthened ARCO Rights
- ARCO rights (Access, Rectification, Cancellation, Opposition) are reinforced, allowing data subjects to oppose certain automated or discriminatory processing without legitimate cause.
Practical Implications
- Companies should review and update their privacy notices, internal procedures, security measures and staff training related to data processing.
Need Legal Counsel?
Our team is ready to support your implementation of the new provisions, minimizing regulatory risks through audits, policy drafting and tailored guidance.
