Companies in certain sectors must enable interoperability between their databases and the PUI and comply with specific identification, technology development and cybersecurity requirements. The deadline to request access expired on March 31, 2026.
On July 16, 2025, a decree amending the LDP and the General Population Law (“LGP”) was published in the Federal Official Gazette, establishing the PUI as a central and mandatory technological tool for the search, location and identification of missing persons.
The new framework provides for the interconnection of certain databases with national registries through web services that enable, among other functions, validation of the Unique Population Registry Code (“CURP”) and the management of information required for search and identification processes.
These obligations apply to companies providing financial, telecommunications, transportation, healthcare, education and parcel delivery services, among other sectors covered by the applicable regulations.
To comply with the interoperability framework, companies must authenticate their identity through an institutional Llave MX account and complete the corresponding registration with the National Population Registry (“RENAPO”). They must also develop their own technological infrastructure to receive official search requests, query their databases using the CURP and report relevant matches to the PUI.
Interconnection is also subject to specific cybersecurity, authentication and technological protocol requirements, as well as security testing designed to identify vulnerabilities before connectivity with the platform is enabled.
The deadline to request access to the PUI expired on March 31, 2026. Companies subject to these obligations that did not complete the required steps within the applicable period may be in breach of the new framework and exposed to administrative proceedings and penalties.
Under Article 43 Bis of the LDP and Article 114 Bis of the LGP, private entities that maintain databases and fail to provide the required access or keep the relevant information updated may be sanctioned by the Ministry of the Interior with fines ranging from 10,000 to 20,000 times the daily value of the Unit of Measurement and Update (“UMA”).
Following the expiration of the deadline, companies subject to the framework should assess their compliance status and, where necessary, develop a remediation strategy. This assessment should address both the applicable legal obligations and the technological, human and cybersecurity resources required to achieve proper interconnection with the PUI.
It will also be important to document the measures adopted to remedy any non-compliance and prepare a response strategy for potential administrative enforcement proceedings, taking into account, where applicable, the possible effects of voluntary compliance.
Von Wobeser y Sierra has experience in compliance, regulatory matters, data privacy, corporate law and administrative litigation and is available to assist companies in assessing their obligations, implementing remediation measures and addressing the requirements associated with the PUI.
