Manage INAI enforcement under Articles 63-67. Article 63 INAI investigation powers including information requests + on-site inspections + emergency measures + Procedure for Imposition of Sanctions (PIS). Article 64 administrative sanctions calculated in DAYS OF MEXICAN GENERAL MINIMUM WAGE (Salario Minimo General) up to 320,000 days (approximately MXN 33 million / USD 1.9 million 2025 minimum wage of MXN 248.93/day - ONE OF HIGHEST PENALTIES IN LATIN AMERICA) for serious violations including: non-existent or deficient Aviso de Privacidad + unlawful disclosure + denial or obstruction of ARCO rights + sensitive data processing without consent + minor data without parental consent + obstructing INAI. Penalties doubled for repeat offenders. Article 67 CRIMINAL PENALTIES up to 3 years imprisonment for unauthorised processing of sensitive data for profit + 6 months to 3 years for negligence affecting sensitive data + 6 months to 5 years for unauthorised obtaining of profit from personal data processing. Recurso de Revision (Review Appeal) under Articles 56-58 to TFJA Federal Administrative Justice Tribunal within 15 days of INAI resolution. Final appeal to Supreme Court of Justice of the Nation (SCJN) on constitutional grounds. Civil claim for damages under Article 58 + Codigo Civil Federal damages framework. Class action available under Codigo Federal de Procedimientos Civiles. INAI public censure + resolution publication + biannual report to Senate. 2025 REFORM: enforcement transferred from autonomous INAI to Secretaria Anticorrupcion y Buen Gobierno (SABG) within executive (independence concerns + bilateral MoU disruption with Spain AEPD + Argentina AAIP + Uruguay URCDP + Peru ANPD + RIPD Network).
This control maps to 80 controls across 41 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 80 it maps to, and the evidence behind each claim, over MCP and REST.