Extinction Of The National Institute For Transparency, Access To Information, And Personal Data Protection.

As we previously reported in an earlier newsletter, in accordance with the recent constitutional reform dated November 28, 2024, the extinction of seven autonomous agencies was decreed, including the National Institute for Transparency, Access to Information, and Personal Data Protection (INAI).

On Thursday, February 20, 2025, a Decree was published in the Official Gazette, enacting a new Federal Law on the Protection of Personal Data Held by Private Parties, as well as a new General Law on the Protection of Personal Data Held by Obligated Subjects.

These two new laws came into force on March 21, 2025, formalizing the extinction of INAI.

After reviewing these laws, it appears that the personal data protection framework—both for data held by private entities and by public entities of the Mexican Government—remains unchanged. There are no modifications to the rights of data subjects or to the obligations of those who process personal data.