The INAI No Longer Exists: What Changes for Your School's Privacy Notice
Emilio Zárate
If the privacy notice families sign when enrolling their children still mentions the INAI, it is referencing an authority that no longer exists. In 2025, both the agency overseeing personal data protection in Mexico and the law regulating it changed, and this directly affects any private school that holds student and family data.
What Disappeared, and Who Is in Charge Now
The National Institute of Transparency, Access to Information, and Personal Data Protection (INAI) ceased to exist on March 21, 2025, when the organic simplification reform came into effect, eliminating seven autonomous agencies. Its functions regarding personal data protection for private entities (businesses, schools, any private institution) were transferred to the Anti-Corruption and Good Governance Secretariat, which assumed them directly: unlike the INAI, its decisions are approved by the head of the Secretariat.
For a private school, this is not just political trivia: it’s the name that must appear in the privacy notice given to each family. If your school's notice still says INAI, it is referencing an authority that no longer exists.
The Law Also Changed, Not Just the Name of the Regulator
On the same day, March 20, 2025, a new Federal Law on the Protection of Personal Data in the Hands of Private Parties was published in the Official Gazette, replacing the previous law of the same name that had been in effect since 2010. It came into force the following day. This is not just cosmetic; it changes what the privacy notice must state and how consent can be requested from data providers.
What the Privacy Notice Must Now Comply With
The law distinguishes two types of notices in Articles 15 and 22. The comprehensive notice, which is the full document, must identify the responsible party (the school, with its address), the categories of personal data processed, indicating which are sensitive, the purposes of processing, distinguishing those that require family consent from those that do not, and the mechanism to exercise access, rectification, cancellation, and opposition rights. The simplified notice is the short version used when data is collected electronically, such as an online form, and only needs to state who is responsible, the purpose of data use, and where to consult the full notice.
What Remains the Same: Families' Rights
The disappearance of the INAI did not erase the rights parents or the student themselves (if of legal age) have over the data the school holds: they can request access to that data, correct it if it’s wrong, ask for its cancellation, or oppose its use for certain purposes. What changed is to whom a complaint should be filed if the school does not comply: it is no longer the INAI, but the Anti-Corruption and Good Governance Secretariat.
What Your School Needs to Review Today
Three specific things, without waiting for a complaint. First: ensure the privacy notice families sign upon enrollment no longer mentions the INAI and cites the correct authority. Second: clearly distinguish which student data are sensitive, such as health information, and which purposes require explicit parental consent. Third: establish a real mechanism, such as an email or form, for families to exercise their rights, and ensure someone at the school knows what to do when such requests arrive.
Get the next note by email
The story, told while it happens. No spam: only when we publish, and you can leave with one click.