The PUI Guidelines (DOF 27 November 2025)
Published in the Diario Oficial de la Federación on 27 November 2025, the Guidelines are the first secondary instrument that develops the obligation created by the LGMDFP reform. We analyse what they regulate, their role in the implementation chain of the Single Identity Platform, and how they relate to the later Technical Manual. Reading for lawyers and compliance teams who need the full regulatory hierarchy.
What they are and where they fit in the hierarchy
The July 2025 reform to the LGMDFP set the substantive duty —to record identity and interconnect to the PUI— but, like any general law, did so in terms that require development. The Guidelines published in the Diario Oficial de la Federación on 27 November 2025 are the administrative instrument that brings that duty down to concrete operating rules, within the framework the law itself authorises.
In the regulatory hierarchy, the Guidelines sit below the law and above the purely technical manuals: they specify the compliance framework without being able to go beyond what the LGMDFP authorises. Their function is to give the lodging obligation applicable contours, so that an operator and an authority know with reasonable certainty what is expected and how it is verified.
For a compliance team, the Guidelines are the piece that turns an abstract legal mandate into a concrete compliance programme. It is the document where the Article 12 Bis duty begins to take operational shape before descending to the technical detail the Manual provides.
The role of the Guidelines in implementation
How they sit between the law and the technical layer.
They develop the law
They turn the substantive duty set by the LGMDFP reform into operating rules.
They define the compliance framework
They specify the applicable scope of the obligation for bound parties and authority.
They precede the Technical Manual
They are the step before the interconnection detail provided by the Technical Manual v1.0 (DOF 23 Jan 2026).
They link to data protection
They frame the processing of personal data that capture and interconnection entail.
Why they matter, even though they are not the law
A common error is to read only the text of the law and consider the compliance analysis exhausted. In Mexican administrative practice, secondary instruments such as the Guidelines are decisive: it is there that the terms the law leaves open are specified and where an authority finds the criteria to verify compliance. Ignoring them leaves an incomplete analysis.
The Guidelines also serve a legal-certainty function for the bound party. By setting operating rules published in the Diario Oficial, they limit discretion and let the operator structure its compliance on a known basis, rather than being left to shifting interpretations. For a firm, the Guidelines are a required reference when opining on a lodging’s situation.
They should be read together, not in isolation. The Guidelines (November 2025) and the Technical Manual (January 2026) form a sequence: the former frame compliance and the latter provides the interconnection detail. The obligation is understood in full only when both are read in light of the Article 12 Bis duty.
How to read the Guidelines within the regulatory set
A reading path so as not to lose the hierarchy or the chronology.
- Start from the legal dutyFirst locate Article 12 Bis of the LGMDFP: it is the source of the obligation the Guidelines develop.
- Read the Guidelines (27 Nov 2025)Identify the compliance framework they specify: applicable scope and operating rules of the obligation.
- Continue with the Technical Manual (23 Jan 2026)Descend to the interconnection detail: endpoints, authentication and encryption to connect to the PUI.
- Await the SNIP Operating ManualThe instrument that will open the access procedure is still pending; without it, full interconnection is not formalised.
What an operator should verify in light of the Guidelines
How to translate the framework into verifiable internal controls.
Identity capture
That the establishment records each guest’s identity in line with the scope the framework specifies.
Register retention
That the record is kept in full and available for the platform’s purposes.
Data security
That the processing of personal data is carried out with the measures the framework frames.
Interconnection readiness
That the means to connect to the PUI are foreseen for when the operating framework allows.
Traceability before the authority
That compliance can be evidenced before the competent search authority.
Consistency with the Manual
That the preparation is consistent with the technical detail the later Technical Manual provides.
Official sources
Operating Guidelines of the Single Identity Platform, published in the Diario Oficial de la Federación on 27 November 2025. Secondary instrument that develops the obligation created by the July 2025 LGMDFP reform (Articles 12 Bis and 43 Bis).
Superior framework: General Law on the Forced Disappearance of Persons, Disappearance Committed by Private Parties, and of the National Search System (LGMDFP). Later technical instrument: Technical Manual v1.0, published in the Diario Oficial de la Federación on 23 January 2026.
Responsible bodies: Ministry of the Interior (SEGOB), National Population Registry (RENAPO) and National Search Commission (CNB), with technical support from the Digital Transformation and Telecommunications Agency (ATDT).