Cybersecurity - Mexico

Mexico has no single, in-force comprehensive cybersecurity statute; requirements are spread across sectoral and data-protection rules and a federal-government policy. The last standalone strategy (Estrategia Nacional de Ciberseguridad) dates to 2017.

The CNBV's general provisions for credit institutions include a dedicated information-security section (arts. 168 Bis 11–17) and Anexo 72 information-security indicators, requiring a CISO, risk monitoring, remediation plans and reporting of security incidents; parallel rules apply to fintech (ITF) entities.

The new Federal Law on Protection of Personal Data Held by Private Parties was published in the DOF on 20 March 2025 and entered into force on 21 March 2025; it mandates risk-based security measures and requires data controllers to immediately notify affected data subjects of security breaches that materially harm their rights.

Published in late 2025 by the Agencia de Transformación Digital y Telecomunicaciones (ATDT), this first specialized federal cyber policy binds the Federal Public Administration across eight strategic axes, creates a national cyber operations center (CSOC) and CSIRT, and gives the ATDT 180 days (to ~mid-June 2026) to issue technical guidelines and compliance criteria.

On 30 April 2025, Senators Luis Donaldo Colosio Riojas and Lucía Trasviña Waldenrath introduced a cybersecurity bill (64 articles) that would create a National Cybersecurity Agency and a Critical Information Infrastructure Registry (RICI) and require regulated operators to appoint a formal cybersecurity officer; it remains a pending initiative, not enacted law.

Absent a dedicated cyber-offenses statute, conduct such as unauthorized access, system damage and data interference is prosecuted under the Federal Criminal Code (Código Penal Federal) provisions on illicit access to computer systems.