Mexico advances cybersecurity laws

Mexico is weighing a package of legislative initiatives in September 2026 that touches artificial intelligence, cybersecurity, digital violence, child protection, and the digital economy. In Mexico City’s congress, lawmakers had already introduced a proposal before the federal Congress to amend the Federal Telecommunications and Broadcasting Law and the Federal Consumer Protection Law on AI and cybersecurity. Federal bills have also been added that seek to create a National Cybersecurity Agency, toughen responses to intimate content generated with AI, and expand obligations around personal data on platforms and financial services.

What does the National Cybersecurity Agency proposal seek to do?

The bill introduced in the Senate would create a Cybersecurity Law and a National Cybersecurity Agency with authority over data protection, personal safety, and critical infrastructure. According to Acento 21’s coverage, the proposal establishes a new federal institutional framework and broadens regulatory oversight in areas that matter to digital operators and entities handling information.

The proposal comes after Mexico City’s congress had already pushed, on September 10, 2024, an initiative to add provisions on telecommunications and consumer protection in the areas of artificial intelligence and cybersecurity. According to Mexico City’s congress, that initiative is moving through the federal legislative process.

What changes are being discussed for digital violence and intimate content?

The Senate has on its agenda a bill that would classify the generation of intimate sexual images, videos, or audio using artificial intelligence and other digital tools without consent as a crime of privacy violation. Coverage by La Jornada Baja California also says the bill includes rules on how platforms and digital apps classify content.

In parallel, Milenio reported that the Senate will review another bill to reform the General Law on the Rights of Girls, Boys, and Adolescents, with obligations for federal, state, and municipal authorities dealing with violence in digital environments. The text adds prevention, response, and punishment measures, along with duties to protect minors’ personal data on platforms and apps.

Diario 7 Noticias also reported on an initiative to add item VII to Article 8 of the General Law on Women’s Access to a Life Free of Violence. The goal is to require the relevant authorities to run permanent campaigns on prevention, digital literacy, and personal data protection against digital violence targeting women.

How would the digital economy affect payments and financial services?

The president’s proposal for a new Digital Economy Law for Digital and Electronic Payments aims to reduce cash use and scale up electronic payments in Mexico, according to Dossier Político, El Financiero, MVS Noticias, Quadratín, PulsoSLP, Puente Libre, and The Rio Times. The text includes a citizen digital record linked to CURP, designed as a tool for authentication and for accessing user documents and information.

Those reports say the citizen digital record would be accepted by financial institutions to verify identity remotely and to open financial services without being physically present. It would also be used for payments, cards, transfers, and QR codes, which would widen the regulatory perimeter around digital identification, custody, security, and data traceability in banks, fintech firms, and payment platforms.

Quadratín, PulsoSLP, and Puente Libre added that the initiative was sent to the Chamber of Deputies along with the 2027 Economic Package as one of three new bills. The Finance Ministry says it is part of a strategy to make digital payments widespread and combat tax evasion without creating new taxes.

Infobae noted that, at the time of its report, this is a bill and not a decree, so its goals, deadlines, and possible obligations could change during parliamentary debate. That regulatory uncertainty also applies to payment operators, e-commerce, and fintech firms, which would be subject to whatever Congress ultimately approves.

Are there changes to personal data protection?

Yes, at least in the practice of a privacy notice template provider. The model privacy notice from cenaly.com says it operates under a new Federal Law on the Protection of Personal Data Held by Private Parties published on March 20, 2025, and effective March 21, 2025, with references to data-processing obligations and ARCO rights.

However, that reference has not been officially confirmed in the material reviewed. The evidence gathered also says there are no mentions of that supposed new LFPDPPP in the official transparency portals consulted or in general news coverage, so it could be an error, a relabeling of the existing law, or a specific reform that has not yet been verified. Until the official legal text, the exact publication date in the Official Gazette, and the status of a "new law" are located, they should be treated as unconfirmed.