Executive Summary
During the extraordinary session period of the Mexican Congress, which concluded on July 1, 2025, key legislative reforms were approved that reshape the Mexican legal framework in areas such as public security, telecommunications, enforced disappearances, and state surveillance. Highlights include the creation of a new Intelligence and Investigation Law, the operational integration of the National Guard under the Ministry of National Defense (SEDENA), the replacement of the Federal Telecommunications Institute (IFT) with a new Telecommunications Regulatory Commission, and the establishment of centralized platforms for monitoring personal data. These measures have direct implications for privacy, international transfers of personal data, institutional control, and the protection of fundamental rights.
Recommended Actions and Key Points
- Assess the scope of the new Intelligence and Investigation Law and its compatibility with principles of data minimization and proportionality in personal data processing.
- Review the interoperability mechanisms of the Central Intelligence Platform and the Unified Identity Platform, considering risks of mass surveillance and implications for cross-border data flows.
- Establish collaboration protocols with authorities in light of the new powers granted to the National Guard and intelligence agencies.
- Update internal privacy policies in response to new obligations for mobile line registration and biometric data centralization.
- Analyze changes to the National Code of Criminal Procedure and the Amparo Law regarding evidence collection and limits to amparo proceedings in security matters.
- Prepare for strategic litigation scenarios in defense of fundamental rights against acts of authority stemming from new intelligence powers.
- Evaluate regulatory risks arising from the replacement of the IFT and the creation of a new Telecommunications Regulatory Commission.
Detail and Context
During the extraordinary session period of the Mexican Congress, which concluded on July 1, 2025, a series of legislative reforms proposed by the Executive Branch were approved through an expedited legislative process (fast track). These reforms, passed in just seven sessions, have sparked intense debate due to their impact on privacy, government surveillance, and fundamental rights.
1. Intelligence and Investigation Law (new)
- Purpose: Establish a legal framework for state intelligence activities.
- Content: Defines procedures for information collection, strategic analysis, and interagency cooperation. Allows access to personal data, geolocation, and communications without prior judicial authorization in certain cases.
2. National Public Security System Law
- Content: Creates the Central Intelligence Platform, a system that integrates public security databases, including biometric information and mobility records.
3. General Law on Enforced Disappearance
- Content: Establishes the Unified Identity Platform, which centralizes records of missing and unidentified persons, with the ability to interoperate with other government databases.
4. Federal Telecommunications and Broadcasting Law (reformed)
- Content: Replaces the Federal Telecommunications Institute (IFT) with a new Telecommunications Regulatory Commission.
- Imposes new obligations for mobile line registration, including biometric validation and geolocation.
Diverging Perspectives
Various civil society organizations, such as R3D (Network in Defense of Digital Rights), have expressed concern over the scope of the new powers granted to authorities in surveillance matters. They argue that the ability to access geolocation data, communications, and personal records without a court order could open the door to mass surveillance practices and undermine fundamental rights such as privacy and data protection.
For its part, the Federal Government has argued that these reforms aim to strengthen national security, improve the response capacity to complex crimes, and modernize the institutional apparatus of the State. According to this view, the integration of intelligence platforms and the reorganization of functions will enable greater operational efficiency and better coordination among agencies.
International Comparison: A Mexican Patriot Act?
The reforms approved in Mexico in July 2025—particularly the new Intelligence and Investigation Law, the integration of centralized data platforms, and the expansion of surveillance powers without judicial oversight—have been compared by various analysts to the U.S. Patriot Act, enacted after the September 11, 2001 attacks.
| Element | Reforms in Mexico (2025) | Patriot Act (U.S., 2001) |
| Expansion of security powers | National Guard under military command with new surveillance powers. | Expansion of FBI and security agency powers. |
| Legal framework for intelligence | Intelligence Law allows data collection without court order. | Electronic surveillance authorized without court order in certain cases. |
| Data centralization | Identity and intelligence platforms with national interoperability. | Federal databases for tracking communications and movements. |
| Official justification | National security, operational efficiency, and fight against organized crime. | Terrorism prevention and national security protection. |
| Social concerns | Risk of mass surveillance and erosion of fundamental rights. | Criticism for infringing on civil liberties and privacy. |
This parallel does not imply a direct legal equivalence but rather suggests a common trend: the strengthening of state surveillance apparatuses in contexts of crisis or insecurity, with profound implications for the balance between security and human rights.
Conclusion and Call to Action
The legislative reforms approved in July 2025 represent a structural shift in Mexico’s security and intelligence apparatus. While the Federal Government has justified these measures as necessary to strengthen national security and modernize public administration, various sectors have warned of the risks they pose to privacy, due process, and fundamental rights.
The parallel with the U.S. Patriot Act is not merely rhetorical: both initiatives arise in crisis contexts and share a logic of expanding state powers under the banner of security. In this context, organizations must anticipate potential regulatory, reputational, and operational impacts these reforms may generate.
We recommend our clients:
- Conduct a regulatory and privacy impact assessment.
- Strengthen internal data protection and authority collaboration policies.
- Establish response protocols for information requests from intelligence or security entities.
- Consult with legal and compliance teams to identify sector-specific risks.
Our team is available to provide specialized advice and support your organization in adapting to this new regulatory environment.
