LFPDPPP for merch clients: how to protect the data that personalizes your products
When you personalize merch with an employee's engraved name, uniform size, RFC for invoicing, shipping address or client email, you are processing personal data that the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) regulates. This guide explains what the law says, what obligations you have as data controller, what you must sign with your suppliers, and what happens when something goes wrong. It is written for HR, marketing, operations and compliance managers.
When LFPDPPP applies in a merch program
LFPDPPP applies whenever you process personal data of individuals for the purpose of production, personalization, delivery or invoicing of merch. The data that typically triggers the law are: name engraved on notebook or thermos, employee number on t-shirt, size and build on uniform, RFC and tax data for invoicing, address for home delivery, email for confirmation, phone for delivery contact.
What the law considers personal data is broader than many people think. A name without surname, an employee number, an address without name, a scanned signature, a photo of the recipient on the kit — all are personal data. If you collect them and transfer them to a supplier to use in production, you are the data controller.
Controller vs processor: the key difference
LFPDPPP distinguishes two roles. The controller decides what data is collected, what it is used for, with whom it is shared and how long it is retained. The processor processes the data on behalf of the controller, without deciding purposes. When you transfer data from your employees to Corp-Merch.MX to engrave names on notebooks, you are the controller and we are the processor.
That distinction matters because the obligations are different. The controller must have a privacy notice, obtain consent when data is financial, patrimonial or sensitive, attend ARCO rights and notify incidents. The processor must follow the controller's instructions, sign a processing agreement, maintain security measures and not transfer the data to third parties without authorization.
The data processing agreement
Each supplier that processes personal data on your behalf must sign a processing agreement. The agreement is a contract that defines scope, timelines, security measures, subcontracting and incident notification. Without an agreement, there is no valid processing and you are exposed if there is an INAI audit.
Corp-Merch.MX signs the agreement with each client who transfers personal data to us for production. The agreement includes clauses on: type of data transferred, purpose of processing, retention period, technical and physical security measures, prohibition of subcontracting without written authorization, incident notification procedure, right of audit by the controller, and return or destruction of data at the end of the service.
The privacy notice on your site and your pieces
If you collect personal data through a website, an email or a landing page to coordinate a merch program, you must have a privacy notice published before the first collection. The notice must explain what data you collect, what you use it for, with whom you share it, how the data subject can exercise ARCO rights and how they can revoke consent.
If you deliver merch with recipient data engraved (for example, a notebook with the employee's name), the internal privacy notice must cover that use. Data physically engraved on a piece is considered personal data processing — the notice must inform the data subject that their name will be engraved on a piece and what it will be used for.
ARCO rights and how to handle them
ARCO rights (Access, Rectification, Cancellation, Opposition) are rights of the data subject. If an employee asks you to cancel their data because they no longer want their name engraved on the notebook, you must attend to the request. When data is physically engraved, cancellation may involve destroying the piece or replacing the engraving — but you cannot refuse without legal cause.
The deadline to handle an ARCO request is twenty business days from receipt, with the possibility to extend fifteen more business days. The response must go to the channel the data subject indicates. If you transferred the data to a supplier, you must coordinate the response with the supplier to ensure the data is also cancelled in their systems.
Security incidents: what to do
A security incident is any event that compromises the confidentiality, integrity or availability of personal data. Examples in a merch program: a laptop with the employee database stolen, a spreadsheet with names and addresses sent in error, a supplier that leaks the database.
When an incident occurs, you must: contain the incident immediately, assess the scope and affected data, notify INAI when the incident is significant, and notify the affected data subjects when the risk is high. The processing agreement you sign with the supplier must specify timelines and channels of notice for incidents originating at the supplier.
Operational best practices
Five practices that help comply with the law without making the process bureaucratic. First, minimize data — only pass to the supplier what is strictly necessary for production and delivery. If the supplier does not need the birth date to engrave a thermos, do not include it in the spreadsheet. Second, encrypt transfers — use encrypted files with passwords sent through a separate channel.
Third, limit access — only authorized personnel of the supplier sees the data, and access is logged. Fourth, short timelines — data is transferred to the supplier, used and returned or destroyed within a defined period (typically thirty calendar days). Fifth, audit — at least once a year, you verify that the supplier complies with the agreed security measures.
Quote your LFPDPPP compliance?
If you are about to launch a merch program with personalized data, share your case. We help you draft the processing agreement, define the strictly necessary data and establish operational security measures. We sign an agreement with each client and audit internally once a year.
Corp-Merch.MX is a Mexican workshop that produces merch. Information about LFPDPPP is informational and reflects provisions in force at the time of publication. We recommend validating specific obligations with your legal area and with INAI. Corp-Merch.MX is not a law firm or certifying body.