On March 20, 2025, a set of reforms with several secondary laws regulating the protection of personal data and transparency (the “Reform”)1 was published in the Official Gazette (“DOF”), implementing the first stage of the Constitutional Reform known as “organic simplification” published in the DOF on December 20, 2024.
As part of the Reform, a new Federal Law for the Protection of Personal Data in Possession of Private Parties (“New Data Protection Law”) IDEM is issued, which upon becoming effective (March 21, 2025), abrogates the previous law of the same name and extinguishes the National Institute for Transparency, Access to Information and Protection of Personal Data (“INAI”).
In general terms, the New Data Protection Law maintains the model of personal data protection based on principles and duties, as well as the administrative sanctions of the previous law. However, some of the most relevant changes set out by the New Data Protection Law include:
(i) Transfers the powers regarding the protection of personal data to the Ministry of Anti-Corruption and Good Government (the “Ministry”).
(ii) Changes of wording and relevant definitions using inclusive language.
(iii) Eliminates the reference to “natural persons” within the definition of “data subject” and limits itself to “persons”, which could lead to interpretations related to the ownership of personal data by legal entities, subject to the interpretation of the Ministry.
(iv) Broadens the grounds for exceptions to the consent requirement.
(v) Modifies certain essential requirements of privacy notices.
(vi) The right of data subjects to oppose automated processing is elevated to the rank of law.
(vii) Specialized federal courts in the protection of personal data will be created and the amparo trial is set forth as a judicial defense action.
On the other hand, while the Reform does not include a specific deadline for the regulated subjects (i.e., individuals or private entities that carry out the processing of personal data) to comply with the new obligations imposed by the New Data Protection Law, from a conservative approach, it could be interpreted that its effects are immediate, as of its entry into force (i.e., March 21, 2025).
We hope this information is useful, should you have any questions about the above please contact us.
Best regards,
Luis Gerardo García Santos Coy
Carlos Mena Labarthe
Mauricio Serralde Rodríguez
Sara Gutierrez Ruiz
Jorge Kargl Pavía