On June 24, 2025, the Senate of the Republic approved the National Law for the Elimination of Bureaucratic Procedures (the “New Law”), whose objective is to streamline and digitalize government procedures through the use of the Llave MX platform, similar to the model currently implemented by Llave CDMX in Mexico City. Although the New Law must still be enacted by the Executive in order to enter into force, its approval has raised various concerns regarding the protection of personal data.
The New Law provides that its implementation and oversight will be under the responsibility of the Digital Transformation and Telecommunications Agency (“ATDT”). While it represents a significant step toward the digital transformation of the Mexican State by requiring agencies and entities of the Federal Public Administration to adopt electronic procedures and eliminate unnecessary requirements, it also poses important challenges, as citizens will be required to provide personal identification information in advance – such as their CURP, biometric data, and other personal data – in order to carry out procedures and access public services online.
This raises a relevant debate about the State’s ability not only to have a robust cybersecurity infrastructure to ensure the protection of the information it collects, but also to ensure the responsible and transparent handling of such data. This concern becomes more pressing after the extinction of the National Institute for Transparency, Access to Information, and Protection of Personal Data, and in view of the imminent centralization of citizens’ personal data in the ATDT, as well as the constant cyberattacks to which such platforms could be exposed.
The New Law also adds to the proposed reform to the Federal Telecommunications and Broadcasting Law, which seeks to revive the National Mobile Phone User Registry a project that was declared unconstitutional by the Supreme Court of Justice of the Nation in 2021, as it not only raised concerns over violations of data protection principles, but also revealed the lack of authority of the State to implement it.
Although its publication in the Official Gazette of the Federation appears imminent, it will be important to wait for the secondary legislation that will define the guidelines under which the ATDT will simplify administrative processes, while also incorporating a progressive approach to guarantee respect for digital rights and the protection of citizens’ personal data.
At Acedo Santamarina, S.C., we remain at your disposal to provide advice on the scope and implications of this New Law.
