Overview
- Authorities reported that sites built on free‑license CMS with generic templates and uncontrolled plugins carry easily exploitable flaws that can expose personal data and enable fraud or identity theft.
- The advisory instructs federal entities and private firms to request institutional guidance to meet compliance obligations and avoid penalties.
- Officials stated that misuse or inadequate protection of personal information can lead to administrative sanctions and, in certain cases, criminal liability.
- The secretariat is auditing procedures inherited from the defunct INAI after finding sanction resolutions that were never executed, which blocked the collection of fines.
- Public concern over Telcel’s line‑linking process, where reports described personal data visible by entering a phone number, served as a catalyst for the notice, though no company was named for sanction.