What happens if there is a data breach in the system?
The incident response protocol in the evidence file kicks in: what counts as an incident, severity levels, response times, who shuts the system down, communication to compliance and to the authority, and a post-incident review. The law requires notifying the data subject immediately. We don’t promise it won’t happen; we promise what happens if it does.
In telecommunications, the Telecommunications Regulatory Commission is also notified, under the line registration rules. Fines under the data protection law reach 320,000 UMA, double with sensitive data.
Sources
- Mexico’s 2025 data protection law, article 19 (immediate notice to the data subject) and articles 58 and 59 (penalties).
- Line registration rules, Official Gazette, December 9, 2025.
Regulatory framework verified against primary sources on November 1, 2026.
- What data leaves my perimeter when I use private AI?
- Do you use our customers’ data to train the model?
- How are data subject rights and the right to object to automated decisions handled?
- How is the system isolated from the internet and the public cloud?
- Do you run controlled attack testing (red teaming), and who leads it?
Discovery sessions, no commitment
With technology, compliance and two process owners. Includes an offline demonstration prepared for your sector, without using your company’s data.
Inventory and obligations
Data in four levels and a first review of what your sector requires.
Three candidate use cases
And the Assessment proposal. The Discovery is credited against the Assessment.
Founding clients program
Three seats, with an explicit discount in exchange for a publishable case and a reference.
Terms
Discovery and evidence pilot at no cost, Assessment at a discount, in exchange for a publishable case, a reference and feedback. Continuous operation is always paid at list price.