On March 20, 2025, a decree was published in the Federal Official Journal by which new laws on transparency and data protection were issued, abrogating the previous ones. The purpose is to guarantee access to public information; strengthen the protection of personal privacy; homologate federal legislation with international standards on the matter; update the laws regarding the use of electronic media and reduce public spending.

Such decree became effective the day after its publication, and among the most relevant changes is the creation of a new decentralized body of the Anti-Corruption and Good Governance Ministry called “Transparency for the People”, which replaces the National Institute of Transparency, Access to Information and Protection of Personal Data. In addition, the functions of access to public information are redistributed among (i) Transparency for the People; (ii) the control and discipline body of the Judicial Power of the Federation; (iii) the internal control units of the autonomous constitutional bodies (if any); (iv) the comptrollers of the Congress of the Union; (v) the Federal Center for Labor Conciliation and Registration and the Federal Court of Conciliation and Arbitration, in relation to labor unions, and (vi) the National Electoral Institute, with respect to political parties.

The new General Law of Access and Transparency to Public Information expressly provides that information related to serious human rights violations or crimes against humanity may not be classified as confidential, although the list of criteria to consider information as confidential is more extensive. It also provides that no person may be subject to judicial or administrative inquisition for exercising his or her right of access to information, nor may this right be restricted by direct or indirect means.

In the new General Law for the Protection of Personal Data in Possession of Obligated Parties, the definition of the entities considered obligated parties is reduced, omitting unions and private persons (individuals or legal entities) that receive public resources or perform acts of authority.

The new Federal Law for the Protection of Personal Data in Possession of Private Parties modifies certain important definitions, such as: Privacy Notice; Database; Consent; Personal Data; Public Access Sources; Data Processing and Data Transfer.

Likewise, the requirements that the privacy notice must contain are modified and the obligation of the responsible parties to have correct and current personal data is provided. New modalities to revoke consent are also provided and, in general, the guidelines for the treatment of confidential information are reinforced.

The resolutions issued by the Anti-Corruption and Good Governance Ministry may only be challenged through amparo proceedings before specialized courts to be enabled by the Federal Judiciary.

In light of the above, it is important to review and adjust internal policies and privacy notices; instruct staff on the new regulation and strengthen security measures in the processing of personal data to be in full compliance with the new regulation.

Any questions or doubts regarding this bulletin should be directed to:

Fernando Rubio
fra@cmgdlaw.com