Mexico: Introduction of amendment increasing data breach reporting duties

Senator José Alberto Galarza Villaseñor introduced an initiative on 29 April 2021 to amend the Federal Law on Protection of Personal Data Held by Private Parties ("data protection law") to increase data security and breach notifications, requiring the reporting of breaches within 72 hours to both the data owner and the National Institute of Transparency, Access to Information and Protection of Personal Data. Furthermore, the territorial scope of the data protection law would be adjusted so every company would have to be able to designate a representative located in Mexico who ensures the fulfillment of the legal obligations. Finally, there would be consequences if the person responsible was not located in Mexico.