New Laws on Transparency and Personal Data Protection in Mexico

New Laws on Transparency and Personal Data Protection in Mexico

March, 2025

On March 20, 2025, the Decree issuing legislation on transparency and personal data protection was published in the Diario Oficial de la Federación, which came into force the day after its publication. The legislative package issues three new laws: (i) the General Law on Transparency and Access to Public Information; (ii) the General Law on the Protection of Personal Data Held by Obligated Subjects; (iii) the Federal Law on the Protection of Personal Data Held by Private Parties.

On March 20, 2025, the Decree issuing legislation on transparency and personal data protection was published in the Diario Oficial de la Federación, which came into force the day after its publication. The legislative package issues three new laws: (i) the General Law on Transparency and Access to Public Information; (ii) the General Law on the Protection of Personal Data Held by Obligated Subjects; (iii) the Federal Law on the Protection of Personal Data Held by Private Parties; and amends Article 37, Section XV, of the Organic Law of the Federal Public Administration.

Thus, among the main points of the Decree are:
• The elimination of the National Institute of Transparency, Access to Information and Personal Data Protection (“INAI”), as a result of the constitutional reform on organic simplification transferring its functions: (i) to the Secretariat of Anti-Corruption and Good Governance (“SABG”); and (ii) to Transparency for the People, an administrative body decentralized from the SABG.
• According to the explanatory statement of the Decree, these modifications aim to generate greater efficiency in the management of access to information requests and in the protection of personal data, while optimizing resources and eliminating duplicities in the governmental structure.
• However, this Decree represents a significant setback in terms of transparency and the right of access to information, being a clear example of this, the elimination of the authority's power to file actions of unconstitutionality and constitutional controversies. Likewise, the Decree incorporates ambiguous concepts such as “Social Peace” and “harm to the State's interest” that allow the authority to reserve access to information.
• In terms of personal data protection, although substantively it seems that there are not many changes, there are also interpretative ambiguities until the corresponding regulations are issued. Such is the case that tacit consent is the general rule for obtaining the consent of the personal data holder, unless legal provisions require express consent.
• Both in terms of transparency and personal data protection, the only recourse will be the amparo trial before District Courts and Circuit Tribunals “specialized in transparency and personal data” that are not yet enabled. Considering the context of recent reforms to the judiciary, the creation of these specialized courts and tribunals constitutes a measure that discourages the protection of human rights.
• The Decree introduces a setback in access to public information and excessive bureaucracy in the supervision of personal data protection in Mexico.