On March 20, 2025, Mexico enacted new laws: General Law on Transparency and Access to Public Information, General Law on the Protection of Personal Data Held by Obligated Entities, and the Federal Law on the Protection of Personal Data Held by Private Parties. These new provisions entirely reconfigured the institutional framework that had prevailed for over two decades, granting two fundamental human rights in Mexico: access to public information and privacy. For purposes of this article, we will focus on the latter.
Under the new legal framework, we would like to highlight what we consider the two most relevant changes so far. The first is the dissolution of INAI -National Institute for Transparency, Access to Information, and Personal Data Protection. INAI was an autonomous entity, independent to the President, Congress and the Judiciary. Its core functions and responsibilities have now been reassigned to a newly established Secretariat for Anti-Corruption and Good Governance, part of the Executive branch, under the President’s organization and authority.
The second highly debated aspect of the reform is the creation of specialized courts within the Federal Judiciary, tasked with adjudicating disputes arising from the exercise of rights in these areas. As of July 1st, 2025, all pending and new litigation proceedings related to public information access or personal data protection are being processed before the newly established 30th Judicial Circuit, headquartered in the state of Aguascalientes.
Looking at this from the bright side, we are positive that this model of judicialization represents a commitment to the technical, impartial, and specialized resolution of disputes, offering an opportunity to strengthen the protection of fundamental rights through clear and consistent jurisprudential standards. Previously, although District and Collegiate Courts were involved, their lack of specialization often led to procedural dismissals rather than substantive rulings.
Nonetheless, the transition to this new framework brings significant challenges, including but not limited to the following:
- The temporary suspension of ongoing proceedings—at least until mid-September 2025—which will be taken over by an entirely new team unfamiliar with the pending cases and required to resume proceedings from where they were left off.
- The risk of overburdening the newly created judicial bodies, combined with uncertainty about the effectiveness of the new model. This is especially concerning given the difficulty of building a strong, specialized body with the technical expertise necessary to resolve disputes arising from rulings and/or sanctions issued by the entity replacing INAI.
- Concerns over accessibility to the new judicial circuit, particularly for populations located far from Aguascalientes. Without robust digital access, this shift may undermine the right to justice for individuals from a remote location.
As we have described, these changes represent a pivotal institutional and jurisdictional shift. Nevertheless, the new laws don’t change substantially privacy or data protection compliance obligations, but many of us are expecting potential new requirements through the pending regulations yet to be published.
In conclusion, while the core principles and compliance obligations under privacy and data protection laws remain largely intact, the institutional restructuring introduces a new layer of complexity and uncertainty. Organizations acting as Controllers or Processors in Mexico should stay alert to forthcoming regulatory developments, as the secondary regulations may bring additional responsibilities or procedural adjustments. Navigating this transition will require careful monitoring and strategic adaptation to ensure continued compliance and prevent legal risks in this evolving landscape.
Article provided by INPLP members: Gabriela Espinosa Cantú, Montserrat Landaverde and José Antonio Arochi (Arochi & Lindner, S.C., Mexico)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
