On July 16, 2025, the Ley del Sistema Nacional de Investigación e Inteligencia en Materia de Seguridad Pública (Law of the National Investigation and Intelligence System for Public Security) was published in the Official Gazette. Its purpose is to establish the goals and govern the integration, operation, and functioning of the National Investigation and Intelligence System for Public Security.
The most notable element of the Law is the creation of the Plataforma Central de Inteligencia (PCI, Central Intelligence Platform), under the responsibility of the National Intelligence Center (CNI), itself dependent on the Ministry of Public Security and Civil Protection (SSPC). The PCI is a database that brings together information from more than 22 public and private registries, including: financial information; health records; social security data; and official identity documentation.
The reform is linked to the creation of the new Biometric CURP: the SSPC and CNI will be able to access, without restriction and directly, fingerprints; facial records; biometric identifiers; geolocation data; and records of public and private services, in order to carry out intelligence tasks in public security and support decision-making by the competent authorities.
The PCI’s purpose is to enable the development of strategic intelligence products to prevent, investigate, and prosecute crimes. Processing and analysis will use systems and programs that receive, transcribe, convert, organize, classify, and interrelate information and data of all kinds, including automation programs and artificial intelligence tools, to generate strategies, actions, and intelligence products that trigger and reinforce special operations.
Under this new legal framework, both government institutions and private companies are required to share information upon request for security purposes, even if not directly related to these tasks.
The reform has drawn significant criticism for its potential risks regarding mass surveillance and personal data protection. It has been noted that the Law may be in tension with Article 16 of the Constitution, which establishes that “no one may be disturbed in their person, family, home, papers or possessions” except upon written order from a judicial authority. The handling of data under the Law opens the door to corruption risks, since none of the 51 articles develops a clear sanctions regime for misuse of information; only Article 51 addresses a confidentiality regime in two paragraphs, without specifying penalties.
At Wolff, Arias & Charua we will be monitoring further developments and remain at your disposal to advise on the specific impact of this reform on your operations.