The government said Tuesday that it had submitted a bill to Congress to postpone until Dec. 1, 2027, the effective date of the new Personal Data Protection Law.

The law, which Congress passed in August 2024, is currently scheduled to take effect on Dec. 1, imposing stringent obligations on public agencies and companies when processing individuals’ private information and recognizing data subjects’ rights.

The purpose of the postponement is “to have the institutional, regulatory and operational conditions necessary for its proper implementation,” the government said in a statement. “The initiative seeks to provide an additional year of preparation for a reform that will have cross-cutting effects on public agencies, companies, foundations and other entities that process personal data,” it explained.

The new bill includes another change: the current law provides that during the first year after it takes effect, “the Personal Data Protection Agency, APDP, which is responsible for ensuring compliance with the law, may impose a written warning as a sanction” only when dealing with smaller companies. The new bill would extend this provision to all companies. In other words, from December 2027 through December 2028, the agency could impose a written warning instead of a financial penalty on all entities it regulates.

The bill also proposes changes to the Personal Data Protection Agency, increasing the number of members of its board from three to five and establishing a quorum of three members.