How are data subject rights and the right to object to automated decisions handled?
No agent decides alone: it gathers, organizes and hands off, and a person reviews before any effect on a customer or an employee. That meets article 27 of Mexico’s data protection law by design. The audit log shows which data each answer consulted, to handle access, rectification, cancellation or objection requests (ARCO rights).
The data processing agreement sets deadlines and owners for data subject requests. The impact assessment, signed by Legal, documents risks to rights and their mitigations before anything is built.
Sources
- Mexico’s 2025 data protection law, article 27, section II (objection to automated processing without human involvement).
- DEBIR governance framework, commitment 2: human oversight.
Regulatory framework verified against primary sources on November 1, 2026.
Discovery sessions, no commitment
With technology, compliance and two process owners. Includes an offline demonstration prepared for your sector, without using your company’s data.
Inventory and obligations
Data in four levels and a first review of what your sector requires.
Three candidate use cases
And the Assessment proposal. The Discovery is credited against the Assessment.
Founding clients program
Three seats, with an explicit discount in exchange for a publishable case and a reference.
Terms
Discovery and evidence pilot at no cost, Assessment at a discount, in exchange for a publishable case, a reference and feedback. Continuous operation is always paid at list price.