Client Alert

Client Alert - Mexico Enacts a New Public Security Law and Creates a Super Powered National Information Database: Implications for Data Privacy, Cross Border Operations, and Compliance

Overview

On July 16, 2025, Mexico enacted the “Ley General del Sistema Nacional de Seguridad Pública” (General Law of the National Public Security System), a sweeping legislative reform that reshapes the country’s public security architecture. While the law aims to enhance coordination and efficiency across federal, state, and municipal security forces, it introduces concerning obligations around data sharing and transparency that may significantly impact individuals, domestic entities, and foreign companies operating in or serving customers in Mexico.

The System: Centralized Power and Broad Data Access

A core component of the law is the creation of an expansive “Sistema Nacional de Información” (National Information System), operated by the Executive Secretariat of the Public Security System. This platform will aggregate data from all levels of government and private stakeholders, including individuals and companies.

Entities subject to the law must provide ongoing and timely data contributions to the system, including information relevant to security, justice, and public order—regardless of whether such entities operate physically within Mexican territory or provide services remotely to Mexican customers.

Critically, the law grants extensive access to this data to a wide range of institutions, including:

- Local police forces, - Municipal and state governments,

- Federal agencies,

- State-owned companies, and

- Other undefined “authorized entities.”

This broad and potentially unrestrained access to sensitive information raises significant concerns around data protection, competitive confidentiality, and the misuse of information—particularly in a country where cybersecurity, law enforcement integrity, and institutional safeguards remain uneven.

Key Compliance Risks for Businesses

1. Data Sharing Obligations: The law requires all sectors to contribute data continuously to the National Information System, potentially including employee information, geolocation, internal investigations, communications, or user metadata.

2. Scope of Application: The obligations extend not only to Mexican companies but also to foreign businesses with remote operations or digital services targeting Mexican users, potentially triggering extraterritorial exposure.

3. Privacy and Security Vulnerabilities: With more than a dozen government bodies granted access to the system—and no clear technical safeguards defined—the risk of data leaks, cybercrime, espionage, or illicit access by organized crime is materially heightened.

4. Lack of Recourse or Transparency: Individuals and businesses may not be notified of the use or access to their data, and legal remedies to contest unlawful access or sharing remain uncertain under the new framework.

Strategic Recommendations

Businesses—especially those in technology, telecommunications, fintech, e-commerce, hospitality, retail education, healthcare and logistics—should take immediate steps to evaluate their exposure:

- Conduct a legal audit of any interaction with Mexican users or regulators.

- Review existing data processing and retention policies to ensure compliance with potential reporting mandates.

- Assess cross-border data transfer protocols in light of broader access by Mexican authorities. - Reinforce cybersecurity protocols to guard against potential breaches due to widened information sharing.

- Consider geo-fencing or data segregation strategies to mitigate extraterritorial regulatory reach.

Conclusion

While the General Law of the National Public Security System seeks to modernize Mexico’s security infrastructure, the breadth of its data-sharing mandates and the permissiveness of access to the National Information System present novel challenges to personal privacy, corporate confidentiality, and due process.

Companies operating in or serving Mexico should be proactive in reviewing their legal obligations and technical safeguards. Failure to act could expose them to significant regulatory, reputational, and criminal risk.

We Can Help

If your company is uncertain about the scope of its obligations under the new law or wishes to proactively manage risk, please contact us.

For additional information, please contact any of the following: Sergio Legorreta at sergio.legorreta@fisherbroyles.com, Jair Bravo at jair.bravo@fisherbroyles.com, with any questions or more specific situations.