Cybersecurity law & regulation in Mexico (2026)
Cybersecurity in Mexico: sectoral rules.
As of mid-2026 Mexico lacks an enacted, economy-wide cybersecurity law; cyber obligations arise from sector-specific regulation (notably banking/fintech rules from the CNBV and Banxico), the 2025 data-protection law's security and breach-notification duties, and a 2025-2030 National Cybersecurity Plan that binds federal agencies. A General Cybersecurity Law creating a national cybersecurity agency and a critical-infrastructure registry was introduced in the Senate in April 2025 and remains under legislative consideration.
Legal framework
No single comprehensive cybersecurity statute. Obligations are distributed across sectoral and cross-cutting rules: financial-sector information-security/cyber requirements issued by the CNBV and Banco de México; breach/security-vulnerability duties under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, 2025); the Penal Code's computer-crime provisions; and the binding National Cybersecurity Plan 2025-2030 / General Cybersecurity Policy for the Federal Public Administration (ATDT). A comprehensive 'Ley General/Federal de Ciberseguridad' is proposed but not yet enacted.
Key points: cybersecurity in Mexico
No comprehensive law yet
Mexico has no single, in-force comprehensive cybersecurity statute; requirements are spread across sectoral and data-protection rules and a federal-government policy. The last standalone strategy (Estrategia Nacional de Ciberseguridad) dates to 2017.
Financial-sector cyber rules (CNBV/Banxico)
The CNBV's general provisions for credit institutions include a dedicated information-security section (arts. 168 Bis 11-17) and Anexo 72 information-security indicators, requiring a CISO, risk monitoring, remediation plans and reporting of security incidents; parallel rules apply to fintech (ITF) entities.
Data-protection security & breach duties (LFPDPPP 2025)
The new Federal Law on Protection of Personal Data Held by Private Parties was published in the DOF on 20 March 2025 and entered into force on 21 March 2025; it mandates risk-based security measures and requires data controllers to immediately notify affected data subjects of security breaches that materially harm their rights.
National Cybersecurity Plan 2025-2030 (federal government)
Published in late 2025 by the Agencia de Transformación Digital y Telecomunicaciones (ATDT), this first specialized federal cyber policy binds the Federal Public Administration across eight strategic axes, creates a national cyber operations center (CSOC) and CSIRT, and gives the ATDT 180 days (to ~mid-June 2026) to issue technical guidelines and compliance criteria.
Proposed General Cybersecurity Law
On 30 April 2025, Senators Luis Donaldo Colosio Riojas and Lucía Trasviña Waldenrath introduced a cybersecurity bill (64 articles) that would create a National Cybersecurity Agency and a Critical Information Infrastructure Registry (RICI) and require regulated operators to appoint a formal cybersecurity officer; it remains a pending initiative, not enacted law.
Computer crime via Penal Code
Absent a dedicated cyber-offenses statute, conduct such as unauthorized access, system damage and data interference is prosecuted under the Federal Criminal Code (Código Penal Federal) provisions on illicit access to computer systems.
Timeline of decisions
- LawPolítica General de Ciberseguridad 2025-2030 Published in DOF, First Legally Binding Federal Cybersecurity Mandate
The Agencia de Transformación Digital y Telecomunicaciones (ATDT) published Mexico's first legally enforceable national cybersecurity policy in the Diario Oficial de la Federación, requiring all federal agencies to appoint an Institutional Cybersecurity Officer within 60 days and establishing a national CSOC and CSIRT under ATDT direction. This supersedes the non-binding 2017 strategy and creates audit obligations for the entire Federal Public Administration.
InfoChannel (reporting DOF/ATDT publication)
- IncidentGuacamaya Hacktivists Breach SEDENA, 6 TB of Classified Military Data Leaked
The hacktivist collective Guacamaya exploited a ProxyShell vulnerability to exfiltrate more than 6 TB of classified documents from Mexico's Ministry of National Defence (SEDENA), the largest military data breach in Mexican history. Leaked files revealed army surveillance of journalists, opposition politicians, and activists; a military IT commander was arrested in March 2023 in connection with the breach.
National Security Archive, George Washington University
- Decision · officialBanxico Circular 4/2019: Mandatory Cybersecurity Requirements for Fintech Institutions
Following the Ley Fintech, Banco de México issued Circular 4/2019 establishing binding operational-security and cybersecurity requirements for financial technology institutions (ITFs), covering virtual-asset custody controls, access management, audit trails, and cyber-incident reporting to Banxico. This was Mexico's first sector-specific cybersecurity rulebook for digital financial services.
Banco de México
- IncidentSPEI Interbank Payment System Cyberattack, ~MXN 300-400 Million Fraudulently Diverted
Attackers compromised the internal SPEI-gateway software of at least five Mexican banks, injecting fraudulent transfer orders that diverted approximately MXN 300-400 million (≈ USD 15-20 million) to mule accounts; accomplices immediately withdrew cash at branches before transfers could be reversed. The incident was Mexico's first large-scale cyber-enabled bank heist and directly prompted Banxico to issue emergency security circulars and tighten SPEI participant access controls.
Hogan Lovells / BSTL
- Guidance · officialEstrategia Nacional de Ciberseguridad (ENCS) Published
Mexico published its first National Cybersecurity Strategy across five pillars (Society & Rights, Economy & Innovation, Public Institutions, Public Security, National Security), formally establishing CERT-MX as the national cyber-incident response body and adopting a multi-stakeholder governance model. The ENCS was the foundational policy document underpinning all subsequent cybersecurity regulation for nearly eight years, until superseded by the 2025 Política General.
Gobierno de México
- Law · officialCybercrime Provisions Added to Federal Penal Code (Articles 211 Bis 1-7)
Reforms to the Código Penal Federal introduced Articles 211 Bis 1-7, criminalising unauthorised access to computer systems, destruction or alteration of data, and electronic system interference, with custodial penalties up to 12 years; these provisions remain the primary federal criminal framework for online offences in the absence of a dedicated cybercrime statute.
Cámara de Diputados — Código Penal Federal
Sources
- gob.mx/atdt/comunicacion/liderara-mexico-ciberresiliencia-en-la-region-con-p
- diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf
- cnbv.gob.mx/Anexos/Anexo%2072%20CUB.pdf
- dof.gob.mx/nota_detalle.php?codigo=5544804&fecha=27/11/2018
- dof.gob.mx/nota_detalle.php?codigo=5555030&fecha=25/03/2019
- infosen.senado.gob.mx/sgsp/gaceta/66/1/2025-04-30-1/assets/documentos/Inic_MC_Sen_Colosio_c
- practiceguides.chambers.com/practice-guides/cybersecurity-2026/mexico
- iapp.org/news/a/mexicos-cybersecurity-framework-in-2025-a-practitioners-guide
Next for Mexico: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 23 May 2026. Methodology & how to cite · State of Technology Regulation 2026