The corp 3 final bundle answers the obligation every Mexican corporate carrying personal data under LFPDPPP (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) lives with: an AES-256 encrypted USB carrying the internal privacy handbook, a sealed document wallet with combination lock for signed consents, a printed copy of the current privacy notice, a plastic card listing the eight statutory principles, and a QR code linking to the basic e-learning course. The CFDI 4.0 invoice goes out per cohort, fully deductible as compliance expense.
Since 2023, INAI (the federal transparency and data protection agency) and the state-level guarantors have increased verification visits and fines for LFPDPPP non-compliance. Fines range from 300 to 320,000 UMAs (Unidades de Medida y Actualización), which in 2026 translate to between roughly $32,000 and $34,400,000 MXN per infringement. For corporates holding databases of more than 10,000 data subjects (employees, customers, suppliers), the maximum fine is the rule, not the exception.
The typical Mexican corporate handles personal data in at least six areas: human resources (employee files), sales (CRM with customer data), marketing (campaign databases), accounting (invoicing with RFC and address), legal (contracts with personal data), operations (access credentials with photo and biometrics). Every area requires personnel trained in personal data handling and equipped with compliance-grade tools.
The corp 3 final bundle ships to every employee who handles personal data as part of the privacy training programme. The training constancia goes out with STPS registration when the trainer is registered, and is archived in the employee file as evidence of training in case of a verification visit. Documentation is preserved for at least five years per the retention period set out in Article 11 of the LFPDPPP regulation.
For corporates in financial, insurance, healthcare and telecom sectors (additional obligated subjects), the kit ships with extended documentation covering sectoral laws: Ley de Instituciones de Crédito, Ley General de Salud, Ley Federal de Telecomunicaciones. The internal privacy handbook is customised with the client's specific processes and delivered in both encrypted digital and physically sealed form for redundancy.
The kit ships in a sealed box with security code, identified by employee RFC for traceability. Each element is marked with corporate wax seal indicating it should not leave the premises.
32 GB USB 3.2 drive with hardware AES-256 encryption, USB-A and USB-C dual connector, FIPS 140-2 level 3 certified metal casing. Preloaded content: corporate internal privacy handbook, current privacy notice, consent templates, ARCO rights templates, incident procedures, privacy officer directory. Password delivered to the employee in a sealed envelope with two-factor confirmation.
Rigid cardboard wallet wrapped in fabric with three-digit combination lock, capacity for 50 physical signed consent forms. A-Z dividers inside and a pocket for the privacy officer's ID card. Outside, a QR code links to the digital document-control system.
Print of the corporate's current privacy notice on security paper with watermark and anti-counterfeiting hologram. Letter size, double-sided, legible font, plain language following INAI recommendations. Annex with the applicable transfers and remissions table. Sequential numbering for delivery control signed by the employee.
PVC card 86x54mm with the principles of lawfulness, consent, quality, information, security, purpose limitation, minimisation and accountability (Article 6 LFPDPPP). QR code on the reverse linking to the 20-minute basic e-learning course. Matte scratch-resistant plastic, 5-year useful life.
The compliance expense is deductible for the Mexican corporate under Article 27 of LISR, fraction I, as an expense strictly indispensable to the business activity. The CFDI 4.0 invoice is issued with USO CFDI G03 (general expenses) when the kit ships to employees as part of internal training, or D02 (training) when paired with a DC-3 constancia signed by an STPS-registered trainer.
For corporates contracting external training with an STPS-registered institution, the invoice splits the training service (line 1) from the materials shipped (lines 2-5). The corporate credits the expense with the invoice, the signed attendance list and the DC-3 constancia when issued. The XML and PDF electronic files are preserved for five years per Article 30 of the CFF.
For corporates operating under RESICO, the kit is invoiced identically because the expense is deductible regardless of the recipient's tax regime. The 16% IVA breaks out line by line on the CFDI 4.0. For deliveries to free zones (the frequent case of IMMEX corporates with plants in Baja California), IVA is set at 0% with the Free Zone complement attached to the XML.
Compliance documentation is delivered to the corporate in digital format with advanced electronic signature from the privacy officer and SAT stamp when applicable. The CFDI XML, signed attendance list, DC-3 constancias when issued and photographic evidence of the training come together in one digital file per cohort, simplifying audit response.
The financial sector (banks, brokerages, insurers, surety companies) handles sensitive personal data (health status, financial position, credit history) and must also comply with the Ley de Instituciones de Crédito and the Ley General de Instituciones y Sociedades Mutualistas de Seguros. A financial corporate that fails to train its personnel on privacy faces additional CNBV and CNSF sanctions on top of INAI fines.
The healthcare sector (private hospitals, clinical labs, practices, pharmacies) handles health personal data considered sensitive under Article 3, fraction VI of LFPDPPP. The corp 3 final bundle ships with extended coverage: electronic clinical file handling guide and NOM-035-SSA3-2012 compliance. Training extends to 40 hours with DC-3 constancia when personnel have patient contact.
The telecom sector (mobile carriers, telcos, ISPs) handles traffic and location data subject to the Ley Federal de Telecomunicaciones and IFT data-protection regime. The kit ships with specific documentation for Article 190 of LFTEL that requires preserving traffic data confidentiality. Training also covers number portability rules.
The retail and e-commerce sector handles purchase-behaviour data, shipping addresses and payment data. Under NOM-151 and e-commerce legislation, the corporate must implement additional security measures to protect transaction data. The kit ships with a practical compliance guide for the most-used Mexican platforms (Shopify, WooCommerce, Tiendanube).
Pricing in MXN before 16% IVA. The corp 3 final bundle starts at $2,650 MXN per unit from MOQ 20 employees. In series of 100 kits or more, the unit cost drops to $2,180 MXN. In annual contracts above 500 kits for corporates with ongoing personnel turnover, the unit cost drops to $1,890 MXN with reserved capacity and safety stock. The CFDI 4.0 invoice goes out with compliance-expense deductibility.
Production runs 12 to 15 business days for kits with preloaded USB and customised privacy notice. Series above 200 kits require 18 to 22 business days with a 4-week lead time before the training date. Privacy-notice customisation requires legal review by the client, who delivers the final version in Word format with track-changes.
For corporates that need the basic 20-minute online course with constancia, we develop it on the client's own LMS platform (Moodle, Canvas, SuccessFactors) with video, downloadable material and final assessment. The constancia is issued automatically on passing with a minimum 80% score. Constancia validity is two years, with automatic renewal via an update course.
Yes. The USB ships with AES-256 encryption plus FIPS 140-2 level 3 certification, meeting NOM-151 requirements for data-message preservation. The corporate can present it to INAI as evidence of technical security measures. The password is delivered to the authorised employee in a sealed envelope and rotated every 90 days per corporate policy.
Yes. The privacy notice is printed with the client's logo, brand colours and own language. Customisation requires the client's legal team to send us the final version with track-changes. We validate the version against Article 27 of the LFPDPPP regulation and issue recommendations if any mandatory element is missing. Final print runs on security paper with anti-counterfeiting hologram.
Yes. For financial sector we add CNBV and CNSF documentation. For healthcare we add NOM-035-SSA3-2012 and clinical-file handling. For telecom we add IFT and LFTEL compliance. For retail we add NOM-151 and e-commerce legislation. The internal privacy handbook adapts to the client's sector at no extra cost when the piece count is the same.
Yes, when the corporate requests it and the trainer is STPS-registered. The DC-3 constancia is issued within 10 business days of passing with at least 80% score. The trainer signs with SAT e.firma and the constancia ships as a digitally stamped PDF. For corporates preferring in-person training, we run a 4-hour course at the client's site with the registered trainer.
For new employees joining after the initial cohort, we ship individual kits with the same content. The invoice goes out separately under the same annual contract. The kit ships within 5 business days of the new hire's start date. The DC-3 constancia is issued on course completion without requiring an in-person cohort. The single-kit price runs 15% higher for individual shipping logistics.
The corporate that ships the corp 3 final bundle and retains DC-3 constancias holds sufficient documentary evidence to demonstrate personnel training in privacy. The documentation is delivered to the client's privacy officer within 24 hours of request. Internal audit can review each employee's file to verify the current constancia and signed privacy notice.