PRACTICE AREAS
Data Protection
Did you know that GDPR fines can be as high as 20 million euros or 4 per cent of global turnover?
We help businesses comply with the GDPR and the LOPDGDD through a comprehensive strategy covering the registration of processing activities and risks, website and corporate policies, agreements with suppliers and employees, customer consents, and technical and organisational measures. We manage data breaches by notifying the AEPD within 72 hours, handle international data transfers and defend clients in disciplinary proceedings, and turn data into an asset using Data Clean Rooms that anonymise it for analysis. Fines can reach 20 million euros or 4 per cent of global turnover; a well-designed compliance programme costs a fraction of that.
Our Approach · Data as an asset, not a risk
Data protection is often seen as a burden. Our approach turns it into a means of control. Knowing exactly what data your company processes, on what legal basis, with which suppliers and what risks are involved is what enables you to utilise information as an asset without exposing yourself to penalties. Being compliant isn’t just about having a folder full of documents; it’s about ensuring the system works when a data breach, a complaint or an inspection occurs.
The work covers the entire cycle, from the identification of data processing operations, what data is collected, for what purposes, which categories of data subjects are involved and on what legal basis, right through to the preparation and maintenance of documentation covering the entire business, including website and corporate policies, agreements with suppliers and staff, customer consents and internal procedures, together with the technical and organisational measures that underpin them.
And when data can deliver greater value, we make it happen. With our anonymisation solutions and Data Clean Rooms, personal information is transformed into global anonymised data that your company can utilise for analysis, measurement and business strategy, whilst fully complying with regulations. We publish our approach openly; the Data Protection Series on our blog is the best example of the level of detail with which we work.
Estrategia integral
Record of data processing activities and risks, web and corporate policies, technical and organisational measures
Documentación global
Website policies, agreements with suppliers and staff, customer consents and internal procedures
Data Clean Rooms
We transform personal data into aggregated, anonymised data for analysis and strategy, in compliance with the regulations
SERVICES
What we do
Comprehensive compliance strategy
We implement the complete system, including a record of processing activities and a risk map, legal bases, data protection impact assessments (DPIAs), web and corporate policies, and the technical and organisational measures that underpin them. Demonstrable compliance with the AEPD – not just a folder full of templates.
Documentation covering the entire business
We draft and maintain web policies, agreements with suppliers under Article 28 of the GDPR, agreements with staff, customer consent forms and internal procedures. A single set of documents that is consistent both with one another and with actual operations.
Data Clean Rooms and anonymisation
We transform personal data into aggregated, anonymised data that your company can utilise for analysis, measurement and business strategy, whilst fully complying with regulations. Data ceases to be a risk and becomes an asset.
Security vulnerabilities
Incident response protocol, risk assessment, notification to the AEPD within 72 hours, notification to those affected where appropriate, and full documentation of the incident.
International transfers
Data flows outside the EEA with safeguards, standard contractual clauses (SCCs), binding corporate rules (BCRs) and data transfer impact assessments. Multinational groups and cloud providers.
Defence before the AEPD
Responses to complaints from data subjects, requests for information and disciplinary proceedings. Representations, evidence and appeals, together with the AEPD’s legal opinions, which we analyse and publish every week.
METHOD
How we work
Initial audit
A comprehensive overview of data processing activities, including what data is processed, for what purposes, on what legal basis and through which service providers.
Comprehensive strategy
A risk-prioritised plan including all documentation, policies, agreements, consents, the Data Protection Impact Assessment (DPIA) and technical and organisational measures.
Implementation and training
The documents cover procedures, processes, security measures and training for teams that process data.
Maintenance and value
Gaps and rights management, updates from the AEPD and the EDPB, and valuable data-related projects such as Data Clean Rooms.
EXPERIENCE
Proven track record
Estrategia integral
Record of data processing activities and risks, web and corporate policies, technical and organisational measures
Documentación global
Website policies, agreements with suppliers and staff, customer consents and internal procedures
Data Clean Rooms
We transform personal data into aggregated, anonymised data for analysis and strategy, in compliance with the regulations
We have advised companies across a range of sectors on the implementation of compliance systems, breach management and defence before the AEPD, and we help our clients derive value from their data through fully compliant anonymisation solutions. Our legal analysis is published openly; the Data Protection Series uses actual judgements and rulings from the AEPD and the Supreme Court to analyse the issues we resolve on a weekly basis.
TEAM
Who advises you
FREQUENTLY ASKED QUESTIONS
What clients ask before engaging us
The entire system, the record of processing activities and the risk map, the legal bases for each processing activity, the website and corporate policies, impact assessments where applicable, and the technical and organisational measures. The aim is for compliance to be demonstrable and to work in practice, not just to exist on paper.
At the very least, the website privacy policy, the record of processing activities, data processing agreements with suppliers who access data (Article 28 of the GDPR), commitments and clauses relating to staff, customer consents where these form the legal basis, and internal procedures for rights and incidents. We draft these as a coherent whole.
It is an environment in which personal data is transformed into aggregated, anonymised data that your company can utilise for analysis, measurement and business strategy. Data that has been properly anonymised falls outside the scope of the GDPR and can therefore be used without the restrictions that apply to personal data, provided that the anonymisation is genuine and robust.
If the breach poses a risk to individuals’ rights, it must be reported to the AEPD without delay and, at the latest, within 72 hours of becoming aware of it. If the risk is high, those affected must also be notified. All breaches, whether reported or not, must be documented internally.
Article 83 of the GDPR provides for two bands: up to 10 million euros or 2 per cent of global annual turnover, and up to 20 million euros or 4 per cent for the most serious infringements, namely those affecting the principles, the rights of data subjects or data transfers. The AEPD determines the level of the fine based on the nature, severity, duration and intent of the breach.
Only with great care. Where data is not obtained directly from the data subject, Article 14 of the GDPR requires that the data subject be informed, within a maximum of one month, of who is processing their data, for what purpose and where it came from, and a valid legal basis is required. The AEPD imposes penalties for the use of lists without complying with this obligation; we analyse this in depth in our Data Protection Series.
We always start with an initial assessment. With the treatment plan laid out on the table, we present you with a comprehensive strategy prioritised by risk, complete with all the necessary documentation and a fixed quote. The first consultation is without obligation.
AREA INSIGHTS
Featured articles
The best proof of how we work is reading us. A selection of our analyses:
Prefer to explore on your own first? Try our free data protection tools.
Protect your data, protect your business
Comprehensive compliance strategy with a fixed budget. Initial consultation with no obligation.