July 31, 2025
On July 16, 2025, an unprecedented legislative package was published in the Federal Official Gazette (Official Journal of the Federation). It comprises key laws on public security, intelligence, telecommunications, and the search for missing persons. Together, these laws reshape the regulatory framework applicable to businesses.
This legislative block includes amendments to laws such as the General Law of Population (Ley General de Población) and the General Law on the Forced Disappearance of Persons, Disappearance Committed by Private Individuals, and the National Search System for Missing Persons (Ley General en Materia de Desaparición Forzada de Personas, Desaparición Cometida por Particulares y del Sistema Nacional de Búsqueda de Personas), as well as the enactment of new statutes, including the following:
- General Law of the National Public Security System (Ley General del Sistema Nacional de Seguridad Pública).
- Law on the National Research and Intelligence System for Public Security (Ley del Sistema Nacional de Investigación e Inteligencia en Materia de Seguridad Pública).
- Law on Telecommunications and Broadcasting (Ley en Materia de Telecomunicaciones y Radiodifusión).
- National Law for the Elimination of Bureaucratic Procedures (Ley Nacional para Eliminar Trámites Burocráticos).
- Law of the National Guard (Ley de la Guardia Nacional).
These laws introduce a new regulatory model that redefines the relationship between the State and the private sector in matters of intelligence and data management, imposing new legal, technical, and operational obligations on individuals and legal entities. In this new environment, companies must act swiftly, strategically, and with specialized legal counsel to avoid imminent legal, financial, and reputational risks.
The newly published provisions impose several obligations on businesses, including:
- Requirement to Request the Biometric Unique Population Registry Code (Clave Única de Registro de Población “CURP”): The CURP with biometric data –established as a mandatory national identification document– must be used in all identity authentication processes and validated through the Single Identity Platform (Plataforma Única de Identidad) managed by the National Population Registry (Registro Nacional de Población). Accordingly, all public and private entities are required to request it for the provision of their procedures and services.
Companies are granted a 90-calendar day period from the entry into force of the law-dated July 17, 2025– to adopt the necessary measures to include the CURP as a requirement in the procedures and services they offer.
- Mandatory Interconnection with Official State Platforms: Individuals and legal entities are required to implement technological interconnection mechanisms with the National Intelligence Platform (Plataforma de Inteligencia Nacional) for the purposes of data transmission, consultation, or cross-referencing in real time, as determined by the competent authorities.
- Mandatory Submission of Information Upon Request: Any individual or legal entity holding databases, records, or relevant information must make it available to the National Intelligence System (Sistema Nacional de Inteligencia) when requested by a competent authority.
- Safekeeping of Personal and Biometric Data: Entities must have sufficient technological infrastructure and organizational measures to collect, safeguard, and, when necessary, transfer biometric and sensitive personal data under conditions of security, traceability, and availability.
- Provide Real-Time Geolocation: The Public Prosecutor´s Office is authorized, under certain circumstances, to request the real-time geolocation of mobile communication devices from telecommunications concessionaires, licensees, phone operators, and service providers, without prior judicial authorization.
These obligations are broad and apply beyond traditionally regulated sectors, meaning all companies must make the necessary adjustments to ensure compliance. The lack of clarity in certain technical concepts could lead to far-reaching interpretations by authorities.
To ensure compliance with the new regulations, both administrative and criminal sanctions may be imposed on those who fail to provide requested information or comply with the new obligations, specifically:
- A fine ranging from 10,000 to 20,000 times the value of the Unit of Measurement and Actualization (Unidad de Medida y Actualización), equivalent to approximately $60,000 to $120,400 USD.
- 1 to 4 years of imprisonment.
These sanctions may apply to any individual or legal entity responsible for compliance, making it essential to evaluate internal risks and adopt immediate corrective measures.
At Basham, Ringe y Correa, S.C., our specialized team in administrative, constitutional, and data protection law is available to provide comprehensive advice on:
- Legal assessment of your operational model under the new framework.
- Strategic response to government requests.
- Filing legal remedies against actions that infringe fundamental rights.
- Preventive support to avoid sanctions or liability due to non-compliance.
We are facing a new legal paradigm that demands foresight and comprehensive counsel for immediate, technically sound, and strategically informed decision-making.
SINCERELY,
GERARDO NIETO MARTÍNEZ
ADOLFO ATHIÉ CERVANTES
DIANA RANGEL LEÓN
RENATA DENISSE BUERÓN VALENZUELA
DANIELA PINEDA ROBLES
ERIKA ITZEL RODÍGUEZ KUSHELEVICH
MARÍA REGINA SOTELO OCEJO
RICARDO ANTONIO TAGLE PASTÉN