Edomex and CDMX move data laws forward

The State of Mexico Congress has called an extraordinary session for August 20, 2026, to review and, if approved, pass new transparency and personal data protection laws, a move that formalizes the end of INFOEM and transfers its responsibilities to Transparencia Mexiquense. At the same time, Mexico City is moving ahead with a reform on digital violence against women, and at the federal level a Cybersecurity Law bill remains under review, with a legislative timetable still described by sources that have not been officially confirmed.

What did the State of Mexico Congress decide?

The state legislature in the State of Mexico called an extraordinary session for August 20, 2026, with the goal of enacting a new Transparency and Access to Public Information Law for the State of Mexico and its municipalities, along with a Personal Data Protection Law for Data Held by Obligated Entities in the State of Mexico and its municipalities.

According to local legislative reporting, the explicit purpose is to approve the secondary laws that formalize INFOEM's disappearance and shift its functions to a new body, Transparencia Mexiquense, which will be attached to the state Comptroller's Office. That body would become the new guarantor of access to information for the executive branch and municipalities.

In joint committees of the State of Mexico Congress, lawmakers are reviewing a bill sent by the governor that, among other points, proposes creating a new specialized personal data protection law, amending the Organic Law of the Public Administration, the Archives Law, the Anti-Corruption System Law, and several administrative and financial codes. It also proposes making Transparencia Mexiquense a decentralized administrative body under the Comptroller's Office, with technical and operational autonomy.

How would the deadlines for information requests change?

An independent legislative analysis warns that the proposed new transparency law in the State of Mexico would extend response times for information requests and could also lengthen the resolution of appeals.

According to Marcaje Legislativo, the standard deadline would increase from 15 to 20 business days, with a possible extension of 7 to 10 business days. In practice, that could push responses to as long as 30 business days and stretch appeal resolution to as much as two months, which would represent a substantial change in transparency obligations for obligated entities.

What will happen to INFOEM and who will answer requests?

More than 90% of the requests currently handled by INFOEM would move to the new model led by Transparencia Mexiquense, while the rest would be divided among other branches of government and internal oversight bodies, according to the regional coverage cited.

During the committee review, state officials said Transparencia Mexiquense will function as a decentralized body of the Comptroller's Office and will concentrate the guarantor role for the executive branch and municipalities. Requests directed to the judiciary and the legislature will remain the responsibility of their own comptroller's offices, and autonomous bodies will have to handle them through their internal oversight units. Transparency units will continue to exist within each obligated entity.

Coverage by OEM and El Sol de Toluca also noted questions from lawmakers about the new body's independence and about the budgetary and administrative challenges involved in replacing a constitutionally autonomous body with an entity attached to the executive branch.

What other initiatives are moving in Mexico?

Mexico City is reviewing a reform to update the definition of digital violence and authorize the Public Prosecutor's Office to immediately order the removal, blocking, destruction or deletion of digital content linked to reported incidents.

The initiative was introduced by Morena lawmaker Brenda Fabiola Ruiz Aguilar before the Permanent Commission and was later sent to the Mexico City Congress' Gender Equality Committee. Lawmaker Ángel Augusto Tamariz Sánchez joined the proposal, according to coverage by La Crónica de Hoy.

At the federal level, QMA.mx estimates that the proposed Cybersecurity Law would be reviewed by the Chamber of Deputies between the second and third quarters of 2026 and that its possible publication in the Official Gazette of the Federation could take place in the second half of 2026. That estimate, however, comes from the source's own tracking and not from an officially confirmed schedule.

In addition, a regional follow-up on data protection and artificial intelligence notes that Mexico has had a new Federal Law on Protection of Personal Data Held by Private Parties since February 2025, and a General Law on Protection of Personal Data Held by Obligated Entities, in force since March 21, 2025, which reshape supervision and compliance in the area.