Mexico: passenger data record

The 2025 data protection laws

The new federal law for the private sector was published in the Diario Oficial de la Federación (DOF) on 20 March 2025 ¹. Its second transitory article repeals the earlier law published on 5 July 2010 ¹. Article 2, XV defines the Secretaría as the Secretaría Anticorrupción y Buen Gobierno ¹.

The law's transitory articles say references to INAI in other laws pass to the bodies that take over its functions ¹. Pending personal data proceedings before INAI go to the Secretaría Anticorrupción y Buen Gobierno ¹. INAI staff and resources are transferred under the fifth transitory article ¹.

Fines run from 100 to 320,000 UMA depending on the violation (article 59) ¹. For sensitive data, the fines may be increased up to twice those amounts ¹.

Rules for public bodies such as INM

INM is a public body, so the Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados applies ². It was published on 20 March 2025 and last reformed on 14 November 2025 ². It names the Secretaría Anticorrupción y Buen Gobierno (article 3, XXVI) and lists internal control bodies as autoridades garantes (article 3, II) ².

The right to data protection can be limited for national security, public order, public security and health (article 6) ². Transfers without consent are allowed when needed for national security (article 64, IX) ². Processing by security and justice bodies is limited to necessary and proportionate cases and data categories (article 74) ².

Advance passenger data rules

Article 46 of the Ley de Migración says airlines, shipping companies and private aircraft and vessels must send INM electronic information on passengers, crew and means of transport entering or leaving Mexico ³. The Reglamento, published on 28 September 2012, lists the data as identifying each passenger and crew member and their valid travel documents (article 43) ⁴. Carriers must check that the document a passenger presents matches the data sent (article 44) ⁴.

INM issued general guidelines for transmitting electronic passenger lists, published in the DOF on 8 November 2012 ⁵. An agreement signed by INM Commissioner Francisco Garduño Yáñez on 30 April 2025 reformed article 7 ⁵. For arrivals, carriers send passenger data within the two hours before departure for Mexico, then a confirmation list after the doors close ⁵. Departures follow the same pattern ⁵. The agreement takes effect 120 days after DOF publication ⁵.

The agreement does not use the term PNR and sets no retention period ⁵.

Audit of the passenger list system

The Auditoría Superior de la Federación (ASF) audited INM's collection of migration service fees for the 2022 public account (audit 2022-5-04K00-19-0193-2023) ⁶. The audit work concluded on 31 January 2024 ⁶. The ASF opinion found INM and the tax administration SAT complied in general with the applicable rules ⁶.

The ASF found that INM's Administrador de Listas Electrónicas de Pasajeros (ALEP) did not report cancelled flights, so they were counted as completed and caused payment differences ⁶. It found no manual to check that flights reported in ALEP matched flights flown ⁶. It recorded 142,373.8 thousand pesos recovered from seven of the eight airlines audited ⁶.

INM responded that it needed specific organisation manuals registered and approved by SEGOB before updating its procedure manuals ⁶. The ASF issued two recommendations, including controls to validate flight information in ALEP ⁶.

Biometric systems

Article 35 of the Ley de Migración lets INM use automated technological tools to check entries and exits ³. The law text we opened names no biometric collection ³.

At the Felipe Ángeles International Airport (AIFA), a biometric E-Gates system for boarding areas was planned with 90 devices, as reported by Diana Zavala and David Santiago in Expansión on 27 January 2022 ⁷. That report said Apollocom was installing the equipment and that a photo database would be created ⁷. The report did not link the system to INM ⁷.

Chronology