Lauded for being able to ‘offer highly specialised legal solutions’, Bird & Bird frequently acts on complex data privacy and data protection mandates, both domestically and internationally. The team advises a diverse roster of high-profile national and international clients from the financial services, healthcare, and sports sectors, to name a few. Practice head Joaquin Muñoz is well-versed in the intricacies of cybersecurity, AI, and data protection matters. Paula Garralón is a recognised authority on privacy issues across the insurance, telecoms, and retail sectors, while Jaime Delgado‘s expertise spans instructions related to software infringement, ePrivacy, and blockchain.
Data privacy and data protection in Spain
Bird & Bird
Praxisleiter:
Joaquín Muñoz
Weitere Kernanwälte:
Paula Garralon; Jaime Delgado
Referenzen
‘The team understood the brief well and executed it effectively. They demonstrated great flexibility, solid subject matter expertise, and strong analytical skills, even with limited context provided by the client.’
‘Joaquín Muñoz and Jaime Delgado have stood out for their flexibility in carrying out the work, their availability and their analytical capacity in the face of a job that was not easy and required a great capacity for analysis and synthesis.’
‘Skills: quick response. Unconditional support. There is a lot of collaboration, and they are always ready to help quickly in whatever is needed, understanding the changing business environment.’
Highlight-Mandate
- Advised the European Commission on the European Blockchain Services Infrastructure (EBSI) and its follow-up, EBSI II, including the launch of the European Blockchain Sandbox.
- Advised Instaleap, a leading provider of last-mile delivery and fulfillment software for major retailers across Latin America and Europe, on all aspects of data protection and privacy compliance.
- Acted as external Data Protection Officer for Tendam Retail S.A., one of Spain’s largest and most iconic fashion retail groups, with over 1,800 points of sale across 80 countries and a strong digital presence through 51 online marketplaces.
Garrigues
The data economy, privacy, and cybersecurity team at Garrigues is geared to handle a broad range of data-related mandates from high-profile clients in both the domestic and international arenas. The group acts for clients operating in a wide range of industries, including financial services, life sciences, and electronics, in regulatory mandates, security incident responses, and issues concerning data monetisation, AI and blockchain. Practice head Alejandro Padín has amassed considerable experience providing advice on data protection compliance, cyber incidents, and privacy litigation. Katiana Otero supports clients from the insurance, oil and gas, and retail sectors, while Álvaro Blanco has brought his experience to bear on both AI and data protection-related matters.
Praxisleiter:
Alejandro Padín
Weitere Kernanwälte:
Katiana Otero; Álvaro Blanco
Referenzen
‘They are very up-to-date and provide preventative advice on improvements to be implemented.’
‘Availability and honesty.’
‘Alejandro Padín – reliable, personable. our trusted long-term adviser.’
Kernmandanten
Residencias de Estudiantes, S.L.
Advent International
Banco Pichincha España, S.A.
AXA IM Alts / Real Assets
BMW Ibérica, S.A.
L’Oreal España, S.A.U.
Caser/Helvetia
Samsung
Total Energies
CBNK Banco De Collectivos, S.A.
Highlight-Mandate
Hogan Lovells Spain
Praised for combining ‘in-depth legal knowledge with a strategic vision closely aligned with clients' business needs’, the data protection and data privacy team at Hogan Lovells Spain delivers a robust offering across privacy, cybersecurity, and information management. The practice utilises the firm’s international footprint to act for both domestic and international clients on complex, cross-border mandates, including regulatory issues concerning AI, data governance, Big Data and international data transfers. Practice head Gonzalo Gállego is geared to handle a broad array of instructions related to AI, data breaches, and GDPR compliance. Santiago De Ampuero Castellanos handles a steady stream of contentious, compliance and commercial matters, while Juan Ramón Robles acts for a diverse client base from the insurance, healthcare, and technology sectors on data processing arrangements and GDPR compliance. Clara Lázaro is active in assisting clients with IT contracts, software licensing agreements, and data processing arrangements.
Praxisleiter:
Gonzalo F. Gállego
Weitere Kernanwälte:
Santiago de Ampuero; Juan Ramón Robles; Clara Lázaro
Referenzen
‘They are excellent. They combine in-depth legal knowledge with a strategic vision closely aligned with clients‘ business needs. Their cross-disciplinary expertise, encompassing related fields such as digital regulation, AI, and technology compliance, adds significant value. They are able to translate future requirements, even those yet to be defined, into practical advice for their clients.’
‘Technical excellence, a proactive, approachable, and decisive attitude allow them to become strategic partners for their clients, thanks to their strong customer focus. Special mention goes to Juan Ramón Robles and Santiago de Ampuero.’
‘A highly capable and cohesive team, with in-depth technical knowledge and considerable experience. They guarantee the success of any project.’
Kernmandanten
APPLUS+
Highlight-Mandate
- Provided ongoing global support to the Applus+ group on data protection matters in Spain and other countries, including on GDPR compliance and other local data protection and e-privacy requirements.
Uría Menéndez
Possessing ‘deep technical knowledge' and 'clear customer focus’, the team at Uría Menéndez acts for a diverse client base from an array of sectors, including retail, tech, and financial services. The cross-disciplinary team is active across the full spectrum of data protection mandates, including data breaches, cybersecurity, data monetisation projects and regulatory compliance. The group is led by Leticia Lopez-Lapuente, who has an established practice advising clients on cybersecurity, proceedings before the Spanish Data Protection Agency, and the use of biometrics and AI. Francisco Javier García is the partner-level name to note in the Barcelona office. Ignacio Esteban Avendaño is frequently instructed by high-profile tech companies, while Mirian Goitia is a key contact in Barcelona for clients from the automotive, financial services, and logistics sectors.
Praxisleiter:
Leticia López-Lapuente
Weitere Kernanwälte:
Francisco Javier García; Ignacio Esteban Avendaño; Mirian Goitia
Referenzen
‘I value the combination of their deep technical knowledge with a clear client focus. The team stands out for its approachability, responsiveness, and ability to transform legal complexity into practical solutions. They work in a coordinated manner and have demonstrated a genuine commitment to the client. Compared to other firms, their direct approach and results-oriented focus set them apart.’
‘Their differentiating value lies in their combination of technical excellence, personal commitment, and business acumen. They are experts in their field and actively engaged in achieving client objectives. They are distinguished by their availability, responsiveness, and practical approach, far exceeding the industry average. Their approachable manner, rigour, and proactive attitude also stand out, qualities that foster trust and make working with them smooth and efficient. Compared to other competitors, their genuine involvement and strategic, rather than merely formalistic, vision are evident.’
‘Good knowledge of the subject, availability, and ability to explain the topics.’
Kernmandanten
Meta
El Corte Inglés
Microsoft
Amazon Web Service
Banco Santander and group companies
FrauDfense
Tik Tok
General Logistics Systems Spain
Toyota
Logalty
Canadian Solar
Lynx Financial Crime Tech
Banco de Crédito del Perú
Anthropic
eDreams
Temu
GrandVision
Highlight-Mandate
- Provides Meta’s group of companies and various digital businesses in Spain, the EU and the US (including Facebook, Instagram, Oculus and WhatsApp) with ongoing advice on privacy, data protection, and data economy matters affecting their platforms and services.
- Providing strategic advice on setting up the global data protection structure, of which all El Corte Inglés group entities will form part, as well as its joint venture with partners in the insurance and finance industries.
Baker McKenzie
Baker McKenzie assembles a robust data privacy, data security, and information management offering capable of handling instructions from an array of national and multinational clients from the tech, retail, and healthcare sectors, to name a few. The team covers a myriad of data privacy and data protection issues, including cybersecurity requirements, regulatory compliance, and cross-border data transfers. The group is led by José María Méndez, who specialises in advising clients from the media and tech industry. Patricia Pérez is sought out for her experience in privacy compliance, drafting and negotiating licences, and proceedings before regulatory authorities, while Pablo Uslé is noted for his prowess advising clients from the TMT, financial services, and retail sectors.
Praxisleiter:
José María Méndez
Weitere Kernanwälte:
Patricia Pérez; Pablo Uslé
Referenzen
‘The team keeps us up to date on the latest developments in data protection regulations.’
Highlight-Mandate
CMS Albiñana y Suárez de Lezo
Possessing a ‘deep understanding of data protection laws’, CMS Albiñana y Suárez de Lezo‘s portfolio of work covers instructions from a wide variety of sectors, including financial services, tech, and insurance companies. Its data protection capabilities span proceedings before the Spanish Data Protection Authority, GDPR and AI compliance, and the handling of cyber breaches. Javier Torre de Silva is experienced in both contentious and regulatory mandates across the TMT sector. Miguel Recio is well-versed in handling data protection compliance programmes and policies in relation to GDPR and AI.
Praxisleiter:
Javier Torre de Silva
Weitere Kernanwälte:
Miguel Recio
Referenzen
‘The CMS team is perfectly coordinated and offers the client innovative solutions for the success of their claims.’
‘The lawyers are experts in data protection law and have extensive knowledge of the administrative procedures followed before the Spanish Data Protection Agency (AEPD), as well as the resulting legal proceedings. This allows them to anticipate decisions and propose intelligent and reasonable solutions. Javier Torre de Silva José and Miguel Recio are recommended.’
‘CMS lawyers have demonstrated a deep understanding of data protection laws and their specificities. They specialise in advising clients on how to comply with regulatory requirements in a timely manner.’
Kernmandanten
Caixabank / Caixabank Payments and Consumer, EFC, EP, SAU
Ferrovial Group
Amazon and Amazon Web Services
Commerzbank AG
Techem Energy Services SL
LOEWE
Sending Transporte y Comunicación
Credit Agricole
Lazard
Primark
Disney+
Neoelectra Energía
Savills Investment Management
EasyJet
Amenitiz
VOLSKWAGEN AG
Instalaciones Torrejón, S.L.
UNO Organización Empresarial de Logística y Transporte
Unicredit Spa Sucursal en España
Webempresa Europa, S.L.
LVMH IBERIA, S.L.
MAXAMCORP INTERNATIONAL, S.L.
Chèque Déjeuner España, S.A.U.
Vypr Validation Technologies Limited
Alía Gestión Integral de Servicios, S.L.
Highlight-Mandate
- Advised Caixabank and Caixabank CPC on the judicial challenge of the fines imposed by the Spanish Data Protection Agency, at that time the highest amount of fines imposed by the said Agency.
- Advising different insurance companies (AIG, Chubb, Generalli) on several cyber incidents regarding their insured companies, including the management of the cyber incident, the notification to the DPA and to the individuals, and the recovery of the compensations paid to the insured companies.
- Providing legal advice to Amazon/Kuiper/Eero on the data protection issues related to the Amazon group.
Ecija
The data protection and data privacy team at Ecija is geared to handle a broad range of instructions from high-profile clients across the financial services, automotive, and energy sectors, among others. The practice covers a myriad of data protection issues, including regulatory compliance, administrative proceedings, technology contracting, and mandates concerning AI and the digital economy. Multinational corporations regularly turn to managing partner Alejandro Touriño for his expertise on contentious IT matters. Teresa Pereyra is relied on by brands across the leisure, transport, and electronics industries for her knowledge of regulatory frameworks and personal information management, while Daniel López is active in cross-border mandates related to data processing and cybersecurity.
Weitere Kernanwälte:
Alejandro Touriño; Teresa Pereyra; Daniel López; Jesús Yáñez; María González; Javier Arnáiz
Referenzen
‘The data protection team in Écija works very well. They are technically skilled and stay very up-to-date on a subject that is quite complex due to its interactions with other departments and its cross-functional nature. Their client relations are very smooth.’
‘It has an exceptional managing partner and an excellent team of counsel. They possess in-depth subject matter knowledge and extensive practical experience.’
Kernmandanten
Iberia
Banco Santander
Mercedes-Benz
Volkswagen
Pepsi Co
Roblox
Burger King
Abbot
Repsol
Iberdrola
Amadeus
MAHOU
The Addeco Group
Rfef
Ferrovial
Goiko
European Central Bank
Highlight-Mandate
- Advises Iberia, Spain’s flagship airline and a key player in the international aviation sector, on a wide range of data protection and technology matters.
- Leads the DORA compliance project for Banco Santander, acting as project counsel for the remediation of all key ICT vendor contracts in alignment with the new EU Digital Operational Resilience Act.
- Advises Mercedes-Benz on legal matters relating to the processing of personal data across its operations and those of the wider corporate group, with a particular focus on the adoption of technological solutions and the development of innovation projects.
Ramón y Cajal Abogados
Lauded as a ‘multidisciplinary team that adapts to the needs of the client’, Ramón y Cajal Abogados‘ data privacy and data protection practice acts for an array of clients from the automotive, tech, and financial services industries, among others. The team has a good spread of experience across cybersecurity, data strategy, and AI-related mandates. Practice head Norman Heckh possesses extensive expertise advising both domestic and international clients alike on data protection and cybersecurity. María Luisa González is well-versed in conducting data protection audits for both public and private sector clients.
Praxisleiter:
Norman Heckh
Weitere Kernanwälte:
María Luisa González; Luis Cedeño
Referenzen
‘Good internal coordination. Approachable team members.’
‘By far, the best thing about the firm is the availability of the team members, especially partner Norman Heckh, who returns calls the same day even when travelling. Another important aspect is that the advice he provides is customised: the response is tailored to the specific circumstances of the group of companies.’
‘Excellent practice and industry leaders for incident response and data protection advice.’
Kernmandanten
CaixaBank
Costco
Alfasigma
EBN Bank
AELEC
Novomatic
AWS
Bosch
Hyundai
UTA
Silgan Holdings
Experian
Level (IAG Group)
Endesa (Enel Group)
Telefónica Digital
Solcasino (Starcasino Group)
Citibox
Carmila (Carrefour Group)
Vithas
Eurofred
Highlight-Mandate
- Conducted a complete review of all of CaixaBank’s privacy impact assessments within the Group (approximately 100), which implies redraft and revaluation, including AI analysis, and drafts of proof of concepts.
- Acts as Data Protection Officer of all Commercial Centres of Unibail-Rodamco in Spain, which is extremely challenging due to the number of entities affected and the responsibility associated.
- Supporting Telefonica Digita on various legal matters, including privacy, within the Open Gateway project of GSMA and further matters.
Andersen in Spain
Andersen in Spain leverages its ‘high technical competence’ to work on the full spectrum of data privacy and data protection mandates across the automotive, pharmaceuticals, and tech industries, to name a few. The practice is led by Isabel Martínez Moriel, who is well-versed in IT regulatory issues and data protection compliance, and also represents clients before the Spanish Data Protection Agency. María Suárez, who assists with audits, due diligence and daily issues concerning the management of data protection in companies.
Praxisleiter:
Isabel Martínez Moriel
Weitere Kernanwälte:
María Suárez; María Zarzalejos; Miriam Romano
Referenzen
‘The Andersen team has demonstrated solid specialisation in key areas such as data protection, regulatory compliance, and security incident management. Their approach stands out for its agility in response, clarity in legal communication, and ability to offer strategic solutions tailored to complex contexts. Professionals like Isabel Martínez, María Zarzalejos, and Miriam Romano have shown a proactive and collaborative attitude, facilitating contract reviews, coordination with authorities such as the Spanish Data Protection Agency (AEPD), and adaptation of business structures to new regulatory frameworks.
‚Compared to other firms, Andersen stands out thanks to its comprehensive approach, which combines legal, technical, and operational aspects. The recognition of the added value of their proposals reflects a perception of excellence and differentiation compared to firms that offer a more limited or fragmented service. Regarding the new developments in their practice, their commitment to technological innovation is noteworthy, especially in the field of artificial intelligence, where they have addressed legal challenges and developed responsible use policies. These initiatives position Andersen as a leading firm in innovation, surpassing other firms.’
‘What truly sets Andersen Law Firm apart is its combination of personalised, friendly, and flexible service with exceptional technical expertise, enabling them to consistently deliver reliable solutions. Professionals like Isabel Martínez, María Zarzalejos, and Miriam Romano are distinguished not only by their legal knowledge but also by their personal commitment, their ability to adapt to client needs, and their proactive approach to problem-solving. This personal touch and practical focus clearly distinguish them from more rigid or impersonal firms, positioning them as a leading legal partner.’
Kernmandanten
Insud Pharma
Encore Capital Group
Heineken Spain
Hyundai
MEDINSA, Aristo Iberia
Arkopharma
Futurelife
Algenex
Airpharm
Mundo Sano
Headspring
Inveravante
Attica21
Okuant
Iberia Cards
Lladró
Ambilamp
Laboratorios Babé
Laboratorios RNB
Highlight-Mandate
- Advises Hyundai Spain on a wide range of data protection and privacy issues as lead counsel to the company’s data protection officer (DPO).
- Advises MEDINSA and Aristo Pharma Iberia, Spanish subsidiaries of the German pharmaceutical company Aristo Pharma GmbH, on a range of data protection issues.
- Advises Iberia Cards, a payment institution and credit card issuer linked to Iberia’s customer loyalty programme, on data protection issues arising from the design and marketing of financial products.
Audens
With a strong following of clients from the TMT, transport and financial sectors, the data privacy and data protection team at Audens handles a steady stream of mandates related to AI, GDPR compliance, and proceedings before the AEPD. Practice head Marcos Mª Judel Meléndrez covers a myriad of data privacy issues spanning audits, litigation, and compliance reviews, while clients from the tech, energy, and telecoms industries regularly turn to José Leandro Núñez García for his extensive experience in the data protection space.
Praxisleiter:
Marcos Mª Judel Meléndrez
Weitere Kernanwälte:
José Leandro Núñez García; Jon Ander Rodríguez; Miguel Villar; Cristina Fraile
Referenzen
‘Our experience with this firm has been very positive and has allowed us to get to know some of the lawyers on the AUDENS team well. Their technical expertise and the quality of their service are particularly noteworthy. They perform solid and rigorous work that demonstrates a broad understanding of the applicable legal framework in the area of data protection. Also noteworthy is the team’s especially practical and useful approach to legal advice. Their ability to adapt to the client’s needs and propose viable and practical solutions is remarkable.’
‘The service provided by the lawyers at AUDENS with whom we have had the opportunity to work, is of a high standard and quality. Among their outstanding qualities are their accessibility and their communication style—agile, direct, and cordial—always maintaining a high level of commitment and building trust with the client. As examples of these qualities, we can cite Marcos Judel (partner), Leandro Nuñez (partner), and Miguel Villar (associate).’
‘They form a young, dynamic and competitive team, but what stands out above other firms is the involvement of the partners and their availability to handle specific issues when necessary.’
Kernmandanten
Base10
Mercado Libre
Face Bank
Galp Energia Spain
GMV Innovating Solutions
Legit.Health
We Are Clickers
BANCO SABADELL
MÁSMÓVIL
Cámara de Comercio de España
Vorwerk España
Entidad Nacional de Acreditación – ENAC (“Spanish Accreditation Body”)
Avanza
Citibox
Highlight-Mandate
- Advised GALP on its data protection strategy in Spain, acting as external DPO for its Spanish subsidiaries, including audits, data rights management, specialised training and legal defence before the AEPD.
- Advised Mercado Libre on GDPR compliance and data governance as external DPO to its Spanish AI subsidiary developing biometric identification systems for online payments and KYC.
- Advised GMV on GDPR and cross-border privacy compliance, including AI risk assessments and governance for an internal profiling tool and the adaptation of policies to Colombian regulations.
Cuatrecasas
The team at Cuatrecasas is well positioned to handle a wide variety of data protection and privacy matters, including regulatory compliance, Data Protection Officer management, and the delivery of new projects. The practice is jointly chaired by Albert Agustinoy, who has amassed considerable experience advising clients on cybersecurity and data breaches, and IP specialist Alejandro Negro. Pablo Tena, a key contact for financial institutions and multinational corporations, advises on data processing matters and privacy and information security projects.
Praxisleiter:
Albert Agustinoy; Alejandro Negro
Weitere Kernanwälte:
Ramon Baradat; Pablo Tena
Kernmandanten
Sony Music Entertainment
Schneider Electric
Binance
Everyday Software
Highlight-Mandate
- Advising Sony Music on data protection, including questions regarding privacy, cookies policies, contract review for personal data protection, carrying out impact assessments and analyzing security breaches.
- Advising Schneider Electric on data protection, including questions regarding privacy, cookies policies, and contract review for personal data protection.
- Advising Everyday Software on data protection for one of the leading companies in HR programmes regarding the adequacy of its data use tools.
PwC Tax & Legal Services
Praised for its ‘practical approach to complex challenges’, PwC Tax & Legal Services possesses a broad data privacy and data protection offering covering regulatory compliance, data breach response, and international data transfers. Practice head Fernando Fernandez-Miranda attracts regular instructions from tech, financial services, and retail clients. A slew of companies from the telecoms and tech sectors routinely turn to Marta Llamazares and Fernando Herrero for their experience advising on compliance strategy.
Praxisleiter:
Fernando Fernández-Miranda
Weitere Kernanwälte:
Fernando Herrero; Marta Llamazares
Referenzen
‘From my perspective, the PwC Tax & Legal privacy team stands out for its combination of deep technical expertise, strategic insight, and practical approach. They have a remarkable ability to interpret complex, multi-jurisdictional privacy regulations and translate them into solutions that make sense in a real business context.‘
‚Fernando Fernández Miranda is particularly impressive for his strategic vision and foresight, consistently providing guidance that balances regulatory requirements with practical application. Marta Llamazares is highly knowledgeable and detail-oriented, with a talent for designing processes that are both efficient and defensible.‘
‚Fernando Herrero brings complementary strengths in operationalising privacy programs and coordinating international projects.‘
Kernmandanten
Bank of China
Inditex
Huawei
General Electric Aerospace
Samsung
Iberdrola
Laboratorios Rovi
Indra
Carrefour
Mapfre
NTT Data
Dachser
Jaguar Land Rover
CSL BERHING
ISDIN
Schreiber Foods
CNP Assurance
DO & CO
Highlight-Mandate
- Assisting the Industrial and Commercial Bank of China with adapting its international privacy programme to comply with the latest transparency requirements under the GDPR and Spanish regulations.
- Assisting Inditex in creating and operating a privacy office that plays a crucial role in managing privacy and data protection issues for all the group’s brands.
- Provide ongoing advisory support to Huawei across a broad spectrum of data protection and privacy matters, with a particular focus on the company’s European operations and its intricate international business model.
Pérez-Llorca
Praised for its ‘in-depth technical knowledge’, Pérez-Llorca advises on the full spectrum of data protection and data privacy mandates, demonstrating particular strength in handling AI and IoT-related work. Raúl Rubio, who remains a first port of call among clients from the financial services and healthcare industries, shares leadership responsibilities with Andy Ramos Gil De La Haza, who regularly receives instructions from the TMT sector. Andrea Sánchez is routinely engaged by multinational corporations seeking advice on regulatory compliance matters.
Praxisleiter:
Andy Ramos; Raúl Rubio
Weitere Kernanwälte:
Andrea Sánchez; Antonio Muñoz; Álvaro Lobo
Referenzen
‘Pérez-Llorca’s data protection team comprises partners and associates with extensive experience in the field of data protection. They not only have a deep understanding of the data protection legislation in the EU and Spain, but also possess strong political sensitivity that enables them to accurately assess regulatory and enforcement trends. ’
‘What truly impressed me was their exceptional responsiveness. We collaborated on an AEDP investigation, and with their timely and efficient assistance, our client successfully submitted a comprehensive written response to AEPD within just one week.‘
‘They excel in knowledge, analytical skills, and willingness to help. Wonderful service.’
Highlight-Mandate
Squire Patton Boggs
Relied on by a variety of clients from across the automotive, retail, and energy sectors, among others, for its ‘extensive regulatory knowledge’, Squire Patton Boggs‘ data privacy and protection practice is active in multijurisdictional compliance projects and incident response mandates. The practice is led by Bartolomé Martín, who is regularly engaged in cybersecurity, e-commerce, and consumer protection matters. Claire Murphy is advising on a growing volume of AI-related issues.
Praxisleiter:
Bartolomé Martín
Weitere Kernanwälte:
Claire Murphy
Referenzen
‘The data protection practice led by Bartolomé Martín is characterised by its strategic perspective, extensive regulatory knowledge, and exceptional ability to anticipate regulatory risks in complex contexts, enabling it to provide effective, rapid solutions aligned with the company’s objectives.‘
‘The true advantage of the team led by Bartolomé Martín lies in its ability to merge technical excellence with an extremely strategic business perspective. They not only interpret regulations but also contextualise them, forecast them, and transform them into a competitive advantage. This initiative, combined with an accessibility and approachability unusual in companies of their size, represents a significant difference compared to their competitors.‘
‚Their multidisciplinary perspective, which combines expertise in cybersecurity, data protection, compliance, and technology, makes them unique. This enables comprehensive consulting tailored to current challenges. Furthermore, their collaborative, clear, and results-oriented approach fosters strong and lasting trust.’
Highlight-Mandate
BROSETA Abogados
BROSETA Abogados supports a wide range of clients from the financial services, tech, and energy sectors (to name a few) on a slew of both contentious and advisory data privacy and protection mandates. Practice head Miguel Geijo regularly advises clients from the biotech industry. Agustín Puente leverages his litigation experience to assist a host of clients with proceedings before the AEPD, while Alicia Coloma acts for both domestic and international companies alike in data protection, e-commerce and IT mandates.
Praxisleiter:
Miguel Geijo
Weitere Kernanwälte:
Agustín Puente; Alicia Coloma; Carolina Vivó
Referenzen
‘Broseta has an excellent team in the field of data protection and privacy. Agustín Puente and Miguel Geijo form a very strong team that combines expertise in the subject matter, knowledge of business needs, and an understanding of how the Spanish Data Protection Agency (AEPD) operates.’
‘Agustín Puente has an excellent understanding of how the Spanish Data Protection Agency (AEPD) operates and the sanctioning process. Miguel Geijo combines knowledge of privacy law with an understanding of the needs of businesses.’
‘What makes them unique is the practicality of their approach and their speed in responding. Their team is highly available, always ready to efficiently address client requests. They provide high-quality advice. Their perspective and guidance on certain European projects have been shared and confirmed by European colleagues. Their writing is excellent, and they explain complex topics with clarity.’
Kernmandanten
Iberdrola
Caixabank
BBVA
Informa D&B, S.M.E
AEB (Spanish Bank Association)
Farmaindustria(Spanish business Association of Pharmaceutical Laboratories)
Cofidis
Unidad Editorial
UNESPA (Spanish business Association of Insurance companies)
Novonordisk
Highlight-Mandate
- Advises Iberdrola, a global leader in networks, energy storage, and clean energy, in driving forward its privacy and data protection strategy to ensure full compliance.
- Provided legal counsel to CaixaBank on a particularly complex sanctioning procedure, stemming from a security breach that allowed one customer to access information related to a specific transaction belonging to another customer.
- Provides ongoing legal advice to BBVA, a leading global financial institution, on all matters related to the implementation and compliance of its data protection strategy.
Clifford Chance
Clifford Chance fields a robust data privacy and data protection offering, which covers high-profile contentious proceedings before the AEPD and ordinary courts, data monetisation projects, international data transfers and data breaches. Leading the team is Fernando Irurzun, who leverages his extensive litigation experience to act for an array of clients from the tech, energy, and telecoms sectors and is regularly supported by Manel Santilari.
Praxisleiter:
Fernando Irurzun
Weitere Kernanwälte:
Manel Santilari
Kernmandanten
Vodafone
Iberdrola
I-DE Redes Eléctricas Inteligentes
Highlight-Mandate
- Represented Iberdrola Group in different appeals before the Spanish Court due to sanctions imposed by the Spanish Data Protection Authority.
- Represented Vodafone España before the Spanish Data Protection Agency and the Spanish Courts in relation to two of the four highest sanctions ever imposed in Spain.
- Advising Carrefour on all data protection matters, including defence before the Spanish Data Protection Agency.
Fieldfisher
Fieldfisher houses a team of data protection and privacy lawyers capable of acting for a diverse client base from the retail, pharmaceutical, and hospitality industries on data protection and GDPR compliance, digital transformation projects, and sanctioning procedures. The practice is led by Carlos Pérez Sanz, who is regularly tasked with various compliance-related mandates concerning AI and GDPR. Sonia Gracia handles a steady stream of personal data protection and digital law mandates from the pharmaceutical, tech, and telecoms sectors.
Praxisleiter:
Carlos Pérez Sanz
Weitere Kernanwälte:
Sonia Gracia; Guillermo Ponce de León Ruiz
Referenzen
‘The Fieldfisher team, which has been advising us for years on data protection and new technologies, is very cohesive, always available, attentive, and respectful to our requests. They cover for each other if one of them is unavailable. We have a regular contact person, which makes things much easier, but as I mentioned, if necessary, the rest of the team steps in, which ensures a quick response.’
‘Guillermo Ponce de León has been our star interlocutor, always attentive and willing to help. He is quick to respond to any questions posed to him and proposes innovative solutions.’
‘The data protection team at Fieldfisher Spain, headed by Carlos Pérez Sanz, has in-depth technical knowledge of the subject, knows the sector in which we operate very well, and provides innovative solutions.’
Kernmandanten
Fundación Hospital De Sant Pau y La Santa Creu
Highlight-Mandate
Gómez-Acebo & Pombo
With the ability to advise on a broad spectrum of data privacy and data protection mandates, Gómez-Acebo & Pombo acts for an array of high-profile clients across the retail, tech, and financial services sectors, among others. Mandates concerning emerging technologies, digital transformation, AI, and tech transactions are all key areas of expertise for the group. The practice is now solely led by IP specialist Bárbara Sainz De Vicuña, following the departure of former co-head Isabela Crespo in October 2025.
Praxisleiter:
Bárbara Sainz de Vicuña
Referenzen
‘Knowledge, flexibility, adaptation to the business, speed.’
Highlight-Mandate
Osborne Clarke
Acting for an array of domestic and international clients, the data privacy and data protection team at Osborne Clarke possesses extensive expertise advising on the management of data breaches and cyber attacks, and the development of data protection policies. Practice head Rafael García del Poyo regularly works with clients from the TMT, automotive, and retail sectors, while Roger Segarra has an established practice advising on data protection and privacy policies regarding data transfers and cloud computing.
Praxisleiter:
Rafael García del Poyo
Weitere Kernanwälte:
Roger Segarra; Mario Gras; Paula Grifols
Kernmandanten
Grifols
Telefèric Group
Citibox Smart Services, S.L.
The GB Foods
Grifols
Telefèric Group
Citibox Smart Services, S.L.
The GB Foods
Highlight-Mandate
- Advising Grifols on the data protection implications of recording and transcription functionalities within chat messaging applications.
- Assisted Citibox with the design and execution of the changes in the personal data flows as a consequence of the corporate restructuring undertaken as a condition of the financing obtained.