Next Generation Partners

Data privacy and data protection in Spain

Bird & Bird

Lauded for being able to ‘offer highly specialised legal solutions’, Bird & Bird frequently acts on complex data privacy and data protection mandates, both domestically and internationally. The team advises a diverse roster of high-profile national and international clients from the financial services, healthcare, and sports sectors, to name a few. Practice head Joaquin Muñoz is well-versed in the intricacies of cybersecurity, AI, and data protection matters. Paula Garralón is a recognised authority on privacy issues across the insurance, telecoms, and retail sectors, while Jaime Delgado‘s expertise spans instructions related to software infringement, ePrivacy, and blockchain.

Praxisleiter:

Joaquín Muñoz


Weitere Kernanwälte:

Paula Garralon; Jaime Delgado


Referenzen

‘The team understood the brief well and executed it effectively. They demonstrated great flexibility, solid subject matter expertise, and strong analytical skills, even with limited context provided by the client.’

‘Joaquín Muñoz and Jaime Delgado have stood out for their flexibility in carrying out the work, their availability and their analytical capacity in the face of a job that was not easy and required a great capacity for analysis and synthesis.’

‘Skills: quick response. Unconditional support. There is a lot of collaboration, and they are always ready to help quickly in whatever is needed, understanding the changing business environment.’

Highlight-Mandate


  • Advised the European Commission  on the European Blockchain Services Infrastructure (EBSI) and its follow-up, EBSI II, including the launch of the European Blockchain Sandbox.
  • Advised Instaleap, a leading provider of last-mile delivery and fulfillment software for major retailers across Latin America and Europe, on all aspects of data protection and privacy compliance.
  • Acted as external Data Protection Officer for Tendam Retail S.A., one of Spain’s largest and most iconic fashion retail groups, with over 1,800 points of sale across 80 countries and a strong digital presence through 51 online marketplaces.

Garrigues

The data economy, privacy, and cybersecurity team at Garrigues is geared to handle a broad range of data-related mandates from high-profile clients in both the domestic and international arenas. The group acts for clients operating in a wide range of industries, including financial services, life sciences, and electronics, in regulatory mandates, security incident responses, and issues concerning data monetisation, AI and blockchain. Practice head Alejandro Padín has amassed considerable experience providing advice on data protection compliance, cyber incidents, and privacy litigation. Katiana Otero supports clients from the insurance, oil and gas, and retail sectors, while Álvaro Blanco has brought his experience to bear on both AI and data protection-related matters.

Praxisleiter:

Alejandro Padín


Weitere Kernanwälte:

Katiana Otero; Álvaro Blanco


Referenzen

‘They are very up-to-date and provide preventative advice on improvements to be implemented.’

‘Availability and honesty.’

‘Alejandro Padín – reliable, personable. our trusted long-term adviser.’

Kernmandanten

Residencias de Estudiantes, S.L.


Advent International


Banco Pichincha España, S.A.


AXA IM Alts / Real Assets


BMW Ibérica, S.A.


L’Oreal España, S.A.U.


Caser/Helvetia


Samsung


Total Energies


CBNK Banco De Collectivos, S.A.


Highlight-Mandate


Hogan Lovells Spain

Praised for combining ‘in-depth legal knowledge with a strategic vision closely aligned with clients' business needs’, the data protection and data privacy team at Hogan Lovells Spain delivers a robust offering across privacy, cybersecurity, and information management. The practice utilises the firm’s international footprint to act for both domestic and international clients on complex, cross-border mandates, including regulatory issues concerning AI, data governance, Big Data and international data transfers. Practice head Gonzalo Gállego is geared to handle a broad array of instructions related to AI, data breaches, and GDPR compliance. Santiago De Ampuero Castellanos handles a steady stream of contentious, compliance and commercial matters, while Juan Ramón Robles acts for a diverse client base from the insurance, healthcare, and technology sectors on data processing arrangements and GDPR compliance. Clara Lázaro is active in assisting clients with IT contracts, software licensing agreements, and data processing arrangements.

Praxisleiter:

Gonzalo F. Gállego


Weitere Kernanwälte:

Santiago de Ampuero; Juan Ramón Robles; Clara Lázaro


Referenzen

‘They are excellent. They combine in-depth legal knowledge with a strategic vision closely aligned with clients‘ business needs. Their cross-disciplinary expertise, encompassing related fields such as digital regulation, AI, and technology compliance, adds significant value. They are able to translate future requirements, even those yet to be defined, into practical advice for their clients.’

‘Technical excellence, a proactive, approachable, and decisive attitude allow them to become strategic partners for their clients, thanks to their strong customer focus. Special mention goes to Juan Ramón Robles and Santiago de Ampuero.’

‘A highly capable and cohesive team, with in-depth technical knowledge and considerable experience. They guarantee the success of any project.’

Kernmandanten

APPLUS+


Highlight-Mandate


  • Provided ongoing global support to the Applus+ group on data protection matters in Spain and other countries, including on GDPR compliance and other local data protection and e-privacy requirements.

Uría Menéndez

Possessing ‘deep technical knowledge' and 'clear customer focus’, the team at Uría Menéndez acts for a diverse client base from an array of sectors, including retail, tech, and financial services. The cross-disciplinary team is active across the full spectrum of data protection mandates, including data breaches, cybersecurity, data monetisation projects and regulatory compliance. The group is led by Leticia Lopez-Lapuente, who has an established practice advising clients on cybersecurity, proceedings before the Spanish Data Protection Agency, and the use of biometrics and AI. Francisco Javier García is the partner-level name to note in the Barcelona office. Ignacio Esteban Avendaño is frequently instructed by high-profile tech companies, while Mirian Goitia is a key contact in Barcelona for clients from the automotive, financial services, and logistics sectors.

Praxisleiter:

Leticia López-Lapuente


Weitere Kernanwälte:

Francisco Javier García; Ignacio Esteban Avendaño; Mirian Goitia


Referenzen

‘I value the combination of their deep technical knowledge with a clear client focus. The team stands out for its approachability, responsiveness, and ability to transform legal complexity into practical solutions. They work in a coordinated manner and have demonstrated a genuine commitment to the client. Compared to other firms, their direct approach and results-oriented focus set them apart.’

‘Their differentiating value lies in their combination of technical excellence, personal commitment, and business acumen. They are experts in their field and actively engaged in achieving client objectives. They are distinguished by their availability, responsiveness, and practical approach, far exceeding the industry average. Their approachable manner, rigour, and proactive attitude also stand out, qualities that foster trust and make working with them smooth and efficient. Compared to other competitors, their genuine involvement and strategic, rather than merely formalistic, vision are evident.’

‘Good knowledge of the subject, availability, and ability to explain the topics.’

Kernmandanten

Meta


WhatsApp


El Corte Inglés


Microsoft


Amazon Web Service


Banco Santander and group companies


FrauDfense


Instagram


Tik Tok


General Logistics Systems Spain


Toyota


Logalty


Canadian Solar


Lynx Financial Crime Tech


Banco de Crédito del Perú


Anthropic


eDreams


Temu


GrandVision


Highlight-Mandate


  • Provides Meta’s group of companies and various digital businesses in Spain, the EU and the US (including Facebook, Instagram, Oculus and WhatsApp) with ongoing advice on privacy, data protection, and data economy matters affecting their platforms and services.
  • Providing strategic advice on setting up the global data protection structure, of which all El Corte Inglés group entities will form part, as well as its joint venture with partners in the insurance and finance industries.

Baker McKenzie

Baker McKenzie assembles a robust data privacy, data security, and information management offering capable of handling instructions from an array of national and multinational clients from the tech, retail, and healthcare sectors, to name a few. The team covers a myriad of data privacy and data protection issues, including cybersecurity requirements, regulatory compliance, and cross-border data transfers. The group is led by José María Méndez, who specialises in advising clients from the media and tech industry. Patricia Pérez is sought out for her experience in privacy compliance, drafting and negotiating licences, and proceedings before regulatory authorities, while Pablo Uslé is noted for his prowess advising clients from the TMT, financial services, and retail sectors.

Praxisleiter:

José María Méndez


Weitere Kernanwälte:

Patricia Pérez; Pablo Uslé


Referenzen

‘The team keeps us up to date on the latest developments in data protection regulations.’

Highlight-Mandate


CMS Albiñana y Suárez de Lezo

Possessing a ‘deep understanding of data protection laws’, CMS Albiñana y Suárez de Lezo‘s portfolio of work covers instructions from a wide variety of sectors, including financial services, tech, and insurance companies. Its data protection capabilities span proceedings before the Spanish Data Protection Authority, GDPR and AI compliance, and the handling of cyber breaches. Javier Torre de Silva is experienced in both contentious and regulatory mandates across the TMT sector. Miguel Recio is well-versed in handling data protection compliance programmes and policies in relation to GDPR and AI.

Praxisleiter:

Javier Torre de Silva


Weitere Kernanwälte:

Miguel Recio


Referenzen

‘The CMS team is perfectly coordinated and offers the client innovative solutions for the success of their claims.’

‘The lawyers are experts in data protection law and have extensive knowledge of the administrative procedures followed before the Spanish Data Protection Agency (AEPD), as well as the resulting legal proceedings. This allows them to anticipate decisions and propose intelligent and reasonable solutions. Javier Torre de Silva José  and Miguel Recio are recommended.’

‘CMS lawyers have demonstrated a deep understanding of data protection laws and their specificities. They specialise in advising clients on how to comply with regulatory requirements in a timely manner.’

Kernmandanten

Caixabank / Caixabank Payments and Consumer, EFC, EP, SAU


Ferrovial Group


Amazon and Amazon Web Services


Commerzbank AG


Techem Energy Services SL


LOEWE


Sending Transporte y Comunicación


Credit Agricole


Lazard


Primark


Disney+


Neoelectra Energía


Savills Investment Management


EasyJet


Amenitiz


VOLSKWAGEN AG


Instalaciones Torrejón, S.L.


UNO Organización Empresarial de Logística y Transporte


Unicredit Spa Sucursal en España


Webempresa Europa, S.L.


LVMH IBERIA, S.L.


MAXAMCORP INTERNATIONAL, S.L.


Chèque Déjeuner España, S.A.U.


Vypr Validation Technologies Limited


Alía Gestión Integral de Servicios, S.L.


Highlight-Mandate


  • Advised Caixabank and Caixabank CPC on the judicial challenge of the fines imposed by the Spanish Data Protection Agency, at that time the highest amount of fines imposed by the said Agency.
  • Advising different insurance companies (AIG, Chubb, Generalli) on several cyber incidents regarding their insured companies, including the management of the cyber incident, the notification to the DPA and to the individuals, and the recovery of the compensations paid to the insured companies.
  • Providing legal advice to Amazon/Kuiper/Eero on the data protection issues related to the Amazon group.

Ecija

The data protection and data privacy team at Ecija is geared to handle a broad range of instructions from high-profile clients across the financial services, automotive, and energy sectors, among others. The practice covers a myriad of data protection issues, including regulatory compliance, administrative proceedings, technology contracting, and mandates concerning AI and the digital economy. Multinational corporations regularly turn to managing partner Alejandro Touriño for his expertise on contentious IT matters. Teresa Pereyra is relied on by brands across the leisure, transport, and electronics industries for her knowledge of regulatory frameworks and personal information management, while Daniel López is active in cross-border mandates related to data processing and cybersecurity.

Weitere Kernanwälte:

Alejandro Touriño; Teresa Pereyra; Daniel López; Jesús Yáñez; María González; Javier Arnáiz


Referenzen

‘The data protection team in Écija works very well. They are technically skilled and stay very up-to-date on a subject that is quite complex due to its interactions with other departments and its cross-functional nature. Their client relations are very smooth.’

‘It has an exceptional managing partner and an excellent team of counsel. They possess in-depth subject matter knowledge and extensive practical experience.’

Kernmandanten

Iberia


Banco Santander


Mercedes-Benz


Volkswagen


Pepsi Co


Roblox


Burger King


Abbot


Repsol


Iberdrola


Amadeus


MAHOU


The Addeco Group


Rfef


Ferrovial


Goiko


European Central Bank


Highlight-Mandate


  • Advises Iberia, Spain’s flagship airline and a key player in the international aviation sector, on a wide range of data protection and technology matters.
  • Leads the DORA compliance project for Banco Santander, acting as project counsel for the remediation of all key ICT vendor contracts in alignment with the new EU Digital Operational Resilience Act.
  • Advises Mercedes-Benz on legal matters relating to the processing of personal data across its operations and those of the wider corporate group, with a particular focus on the adoption of technological solutions and the development of innovation projects.

Ramón y Cajal Abogados

Lauded as a ‘multidisciplinary team that adapts to the needs of the client’, Ramón y Cajal Abogados‘ data privacy and data protection practice acts for an array of clients from the automotive, tech, and financial services industries, among others. The team has a good spread of experience across cybersecurity, data strategy, and AI-related mandates. Practice head Norman Heckh possesses extensive expertise advising both domestic and international clients alike on data protection and cybersecurity. María Luisa González  is well-versed in conducting data protection audits for both public and private sector clients.

Praxisleiter:

Norman Heckh


Weitere Kernanwälte:

María Luisa González; Luis Cedeño


Referenzen

‘Good internal coordination. Approachable team members.’

‘By far, the best thing about the firm is the availability of the team members, especially partner Norman Heckh, who returns calls the same day even when travelling. Another important aspect is that the advice he provides is customised: the response is tailored to the specific circumstances of the group of companies.’

‘Excellent practice and industry leaders for incident response and data protection advice.’

Kernmandanten

CaixaBank


Costco


Alfasigma


EBN Bank


AELEC


Novomatic


AWS


Bosch


Hyundai


UTA


Silgan Holdings


Experian


Level (IAG Group)


Endesa (Enel Group)


Telefónica Digital


Solcasino (Starcasino Group)


Citibox


Carmila (Carrefour Group)


Vithas


Eurofred


Highlight-Mandate


  • Conducted a complete review of all of CaixaBank’s privacy impact assessments within the Group (approximately 100), which implies redraft and revaluation, including AI analysis, and drafts of proof of concepts.
  • Acts as Data Protection Officer of all Commercial Centres of Unibail-Rodamco in Spain, which is extremely challenging due to the number of entities affected and the responsibility associated.
  • Supporting Telefonica Digita on various legal matters, including privacy, within the Open Gateway project of GSMA and further matters.

Andersen in Spain

Andersen in Spain leverages its ‘high technical competence’ to work on the full spectrum of data privacy and data protection mandates across the automotive, pharmaceuticals, and tech industries, to name a few. The practice is led by Isabel Martínez Moriel, who is well-versed in IT regulatory issues and data protection compliance, and also represents clients before the Spanish Data Protection Agency. María Suárez, who assists with audits, due diligence and daily issues concerning the management of data protection in companies.

Praxisleiter:

Isabel Martínez Moriel


Weitere Kernanwälte:

María Suárez;  María Zarzalejos; Miriam Romano


Referenzen

‘The Andersen team has demonstrated solid specialisation in key areas such as data protection, regulatory compliance, and security incident management. Their approach stands out for its agility in response, clarity in legal communication, and ability to offer strategic solutions tailored to complex contexts. Professionals like Isabel Martínez, María Zarzalejos, and Miriam Romano have shown a proactive and collaborative attitude, facilitating contract reviews, coordination with authorities such as the Spanish Data Protection Agency (AEPD), and adaptation of business structures to new regulatory frameworks.

‚Compared to other firms, Andersen stands out thanks to its comprehensive approach, which combines legal, technical, and operational aspects. The recognition of the added value of their proposals reflects a perception of excellence and differentiation compared to firms that offer a more limited or fragmented service. Regarding the new developments in their practice, their commitment to technological innovation is noteworthy, especially in the field of artificial intelligence, where they have addressed legal challenges and developed responsible use policies. These initiatives position Andersen as a leading firm in innovation, surpassing other firms.’

‘What truly sets Andersen Law Firm apart is its combination of personalised, friendly, and flexible service with exceptional technical expertise, enabling them to consistently deliver reliable solutions. Professionals like Isabel Martínez, María Zarzalejos, and Miriam Romano are distinguished not only by their legal knowledge but also by their personal commitment, their ability to adapt to client needs, and their proactive approach to problem-solving. This personal touch and practical focus clearly distinguish them from more rigid or impersonal firms, positioning them as a leading legal partner.’

Kernmandanten

Insud Pharma


Encore Capital Group


Heineken Spain


Hyundai


MEDINSA, Aristo Iberia


Arkopharma


Futurelife


Algenex


Airpharm


Mundo Sano


Headspring


Inveravante


Attica21


Okuant


Iberia Cards


Lladró


Ambilamp


Laboratorios Babé


Laboratorios RNB


Highlight-Mandate


  • Advises Hyundai Spain on a wide range of data protection and privacy issues as lead counsel to the company’s data protection officer (DPO).
  • Advises MEDINSA and Aristo Pharma Iberia, Spanish subsidiaries of the German pharmaceutical company Aristo Pharma GmbH, on a range of data protection issues.
  • Advises Iberia Cards, a payment institution and credit card issuer linked to Iberia’s customer loyalty programme, on data protection issues arising from the design and marketing of financial products.

Audens

With a strong following of clients from the TMT, transport and financial sectors, the data privacy and data protection team at Audens handles a steady stream of mandates related to AI, GDPR compliance, and proceedings before the AEPD. Practice head Marcos Mª Judel Meléndrez covers a myriad of data privacy issues spanning audits, litigation, and compliance reviews, while clients from the tech, energy, and telecoms industries regularly turn to José Leandro Núñez García for his extensive experience in the data protection space.

Praxisleiter:

Marcos Mª Judel Meléndrez


Weitere Kernanwälte:

José Leandro Núñez García; Jon Ander Rodríguez; Miguel Villar; Cristina Fraile


Referenzen

‘Our experience with this firm has been very positive and has allowed us to get to know some of the lawyers on the AUDENS team well. Their technical expertise and the quality of their service are particularly noteworthy. They perform solid and rigorous work that demonstrates a broad understanding of the applicable legal framework in the area of data protection. Also noteworthy is the team’s especially practical and useful approach to legal advice. Their ability to adapt to the client’s needs and propose viable and practical solutions is remarkable.’

‘The service provided by the lawyers at AUDENS with whom we have had the opportunity to work, is of a high standard and quality. Among their outstanding qualities are their accessibility and their communication style—agile, direct, and cordial—always maintaining a high level of commitment and building trust with the client. As examples of these qualities, we can cite Marcos Judel (partner), Leandro Nuñez (partner), and Miguel Villar (associate).’

‘They form a young, dynamic and competitive team, but what stands out above other firms is the involvement of the partners and their availability to handle specific issues when necessary.’

Kernmandanten

Base10


Mercado Libre


Face Bank


Galp Energia Spain


GMV Innovating Solutions


‍Legit.Health


‍We Are Clickers


BANCO SABADELL


MÁSMÓVIL


Cámara de Comercio de España


Vorwerk España


Entidad Nacional de Acreditación – ENAC (“Spanish Accreditation Body”)


Avanza


Citibox


Highlight-Mandate


  • Advised GALP on its data protection strategy in Spain, acting as external DPO for its Spanish subsidiaries, including audits, data rights management, specialised training and legal defence before the AEPD.
  • Advised Mercado Libre on GDPR compliance and data governance as external DPO to its Spanish AI subsidiary developing biometric identification systems for online payments and KYC.
  • Advised GMV on GDPR and cross-border privacy compliance, including AI risk assessments and governance for an internal profiling tool and the adaptation of policies to Colombian regulations.

Cuatrecasas

The team at Cuatrecasas is well positioned to handle a wide variety of data protection and privacy matters, including regulatory compliance, Data Protection Officer management, and the delivery of new projects. The practice is jointly chaired by Albert Agustinoy, who has amassed considerable experience advising clients on cybersecurity and data breaches, and IP specialist Alejandro Negro. Pablo Tena, a key contact for financial institutions and multinational corporations, advises on data processing matters and privacy and information security projects.

Praxisleiter:

Albert Agustinoy; Alejandro Negro


Weitere Kernanwälte:

Ramon Baradat; Pablo Tena


Kernmandanten

Sony Music Entertainment


Schneider Electric


Binance


Everyday Software


Highlight-Mandate


  • Advising Sony Music on data protection, including questions regarding privacy, cookies policies, contract review for personal data protection, carrying out impact assessments and analyzing security breaches.
  • Advising Schneider Electric on data protection, including questions regarding privacy, cookies policies, and contract review for personal data protection.
  • Advising Everyday Software on data protection for one of the leading companies in HR programmes regarding the adequacy of its data use tools.

PwC Tax & Legal Services

Praised for its ‘practical approach to complex challenges’, PwC Tax & Legal Services possesses a broad data privacy and data protection offering covering regulatory compliance, data breach response, and international data transfers. Practice head Fernando Fernandez-Miranda attracts regular instructions from tech, financial services, and retail clients. A slew of companies from the telecoms and tech sectors routinely turn to Marta Llamazares and Fernando Herrero for their experience advising on compliance strategy.

Praxisleiter:

Fernando Fernández-Miranda


Weitere Kernanwälte:

Fernando Herrero; Marta Llamazares


Referenzen

‘From my perspective, the PwC Tax & Legal privacy team stands out for its combination of deep technical expertise, strategic insight, and practical approach. They have a remarkable ability to interpret complex, multi-jurisdictional privacy regulations and translate them into solutions that make sense in a real business context.‘

‚Fernando Fernández Miranda is particularly impressive for his strategic vision and foresight, consistently providing guidance that balances regulatory requirements with practical application. Marta Llamazares is highly knowledgeable and detail-oriented, with a talent for designing processes that are both efficient and defensible.‘

‚Fernando Herrero brings complementary strengths in operationalising privacy programs and coordinating international projects.‘

Kernmandanten

Bank of China


Inditex


Huawei


General Electric Aerospace


Samsung


Iberdrola


Laboratorios Rovi


Indra


Carrefour


Mapfre


NTT Data


Dachser


Jaguar Land Rover


CSL BERHING


ISDIN


Schreiber Foods


CNP Assurance


DO & CO


Highlight-Mandate


  • Assisting the Industrial and Commercial Bank of China with adapting its international privacy programme to comply with the latest transparency requirements under the GDPR and Spanish regulations.
  • Assisting Inditex in creating and operating a privacy office that plays a crucial role in managing privacy and data protection issues for all the group’s brands.
  • Provide ongoing advisory support to Huawei across a broad spectrum of data protection and privacy matters, with a particular focus on the company’s European operations and its intricate international business model.

Pérez-Llorca

Praised for its ‘in-depth technical knowledge’, Pérez-Llorca advises on the full spectrum of data protection and data privacy mandates, demonstrating particular strength in handling AI and IoT-related work. Raúl Rubio, who remains a first port of call among clients from the financial services and healthcare industries, shares leadership responsibilities with Andy Ramos Gil De La Haza, who regularly receives instructions from the TMT sector. Andrea Sánchez is routinely engaged by multinational corporations seeking advice on regulatory compliance matters.

Praxisleiter:

Andy Ramos; Raúl Rubio


Weitere Kernanwälte:

Andrea Sánchez; Antonio Muñoz; Álvaro Lobo


Referenzen

‘Pérez-Llorca’s data protection team comprises partners and associates with extensive experience in the field of data protection. They not only have a deep understanding of the data protection legislation in the EU and Spain, but also possess strong political sensitivity that enables them to accurately assess regulatory and enforcement trends. ’

‘What truly impressed me was their exceptional responsiveness. We collaborated on an AEDP investigation, and with their timely and efficient assistance, our client successfully submitted a comprehensive written response to AEPD within just one week.‘

‘They excel in knowledge, analytical skills, and willingness to help. Wonderful service.’

Highlight-Mandate


Squire Patton Boggs

Relied on by a variety of clients from across the automotive, retail, and energy sectors, among others, for its ‘extensive regulatory knowledge’, Squire Patton Boggs‘ data privacy and protection practice is active in multijurisdictional compliance projects and incident response mandates. The practice is led by Bartolomé Martín, who is regularly engaged in cybersecurity, e-commerce, and consumer protection matters. Claire Murphy is advising on a growing volume of AI-related issues.

Praxisleiter:

Bartolomé Martín


Weitere Kernanwälte:

Claire Murphy


Referenzen

‘The data protection practice led by Bartolomé Martín is characterised by its strategic perspective, extensive regulatory knowledge, and exceptional ability to anticipate regulatory risks in complex contexts, enabling it to provide effective, rapid solutions aligned with the company’s objectives.‘

‘The true advantage of the team led by Bartolomé Martín lies in its ability to merge technical excellence with an extremely strategic business perspective. They not only interpret regulations but also contextualise them, forecast them, and transform them into a competitive advantage. This initiative, combined with an accessibility and approachability unusual in companies of their size, represents a significant difference compared to their competitors.‘

‚Their multidisciplinary perspective, which combines expertise in cybersecurity, data protection, compliance, and technology, makes them unique. This enables comprehensive consulting tailored to current challenges. Furthermore, their collaborative, clear, and results-oriented approach fosters strong and lasting trust.’

Highlight-Mandate


BROSETA Abogados

BROSETA Abogados supports a wide range of clients from the financial services, tech, and energy sectors (to name a few) on a slew of both contentious and advisory data privacy and protection mandates. Practice head Miguel Geijo regularly advises clients from the biotech industry. Agustín Puente leverages his litigation experience to assist a host of clients with proceedings before the AEPD, while Alicia Coloma acts for both domestic and international companies alike in data protection, e-commerce and IT mandates.

Praxisleiter:

Miguel Geijo


Weitere Kernanwälte:

Agustín Puente; Alicia Coloma; Carolina Vivó


Referenzen

‘Broseta has an excellent team in the field of data protection and privacy. Agustín Puente and Miguel Geijo form a very strong team that combines expertise in the subject matter, knowledge of business needs, and an understanding of how the Spanish Data Protection Agency (AEPD) operates.’

‘Agustín Puente has an excellent understanding of how the Spanish Data Protection Agency (AEPD) operates and the sanctioning process. Miguel Geijo combines knowledge of privacy law with an understanding of the needs of businesses.’

‘What makes them unique is the practicality of their approach and their speed in responding. Their team is highly available, always ready to efficiently address client requests. They provide high-quality advice. Their perspective and guidance on certain European projects have been shared and confirmed by European colleagues. Their writing is excellent, and they explain complex topics with clarity.’

Kernmandanten

Iberdrola


Caixabank


BBVA


Informa D&B, S.M.E


AEB (Spanish Bank Association)


Farmaindustria(Spanish business Association of Pharmaceutical Laboratories)


Cofidis


Unidad Editorial


UNESPA (Spanish business Association of Insurance companies)


Novonordisk


Highlight-Mandate


  • Advises Iberdrola, a global leader in networks, energy storage, and clean energy, in driving forward its privacy and data protection strategy to ensure full compliance.
  • Provided legal counsel to CaixaBank on a particularly complex sanctioning procedure, stemming from a security breach that allowed one customer to access information related to a specific transaction belonging to another customer.
  • Provides ongoing legal advice to BBVA, a leading global financial institution, on all matters related to the implementation and compliance of its data protection strategy.

Clifford Chance

Clifford Chance fields a robust data privacy and data protection offering, which covers high-profile contentious proceedings before the AEPD and ordinary courts, data monetisation projects, international data transfers and data breaches. Leading the team is Fernando Irurzun, who leverages his extensive litigation experience to act for an array of clients from the tech, energy, and telecoms sectors and is regularly supported by Manel Santilari.

Praxisleiter:

Fernando Irurzun


Weitere Kernanwälte:

Manel Santilari


Kernmandanten

Vodafone


Iberdrola


I-DE Redes Eléctricas Inteligentes


Highlight-Mandate


  • Represented Iberdrola Group in different appeals before the Spanish Court due to sanctions imposed by the Spanish Data Protection Authority.
  • Represented Vodafone España before the Spanish Data Protection Agency and the Spanish Courts in relation to two of the four highest sanctions ever imposed in Spain.
  • Advising Carrefour on all data protection matters, including defence before the Spanish Data Protection Agency.

Fieldfisher

Fieldfisher houses a team of data protection and privacy lawyers capable of acting for a diverse client base from the retail, pharmaceutical, and hospitality industries on data protection and GDPR compliance, digital transformation projects, and sanctioning procedures. The practice is led by Carlos Pérez Sanz, who is regularly tasked with various compliance-related mandates concerning AI and GDPR. Sonia Gracia handles a steady stream of personal data protection and digital law mandates from the pharmaceutical, tech, and telecoms sectors.

Praxisleiter:

Carlos Pérez Sanz


Weitere Kernanwälte:

Sonia Gracia; Guillermo Ponce de León Ruiz


Referenzen

‘The Fieldfisher team, which has been advising us for years on data protection and new technologies, is very cohesive, always available, attentive, and respectful to our requests. They cover for each other if one of them is unavailable. We have a regular contact person, which makes things much easier, but as I mentioned, if necessary, the rest of the team steps in, which ensures a quick response.’

‘Guillermo Ponce de León has been our star interlocutor, always attentive and willing to help. He is quick to respond to any questions posed to him and proposes innovative solutions.’

‘The data protection team at Fieldfisher Spain, headed by Carlos Pérez Sanz, has in-depth technical knowledge of the subject, knows the sector in which we operate very well, and provides innovative solutions.’

Kernmandanten

Fundación Hospital De Sant Pau y La Santa Creu


Highlight-Mandate


Gómez-Acebo & Pombo

With the ability to advise on a broad spectrum of data privacy and data protection mandates, Gómez-Acebo & Pombo acts for an array of high-profile clients across the retail, tech, and financial services sectors, among others. Mandates concerning emerging technologies, digital transformation, AI, and tech transactions are all key areas of expertise for the group. The practice is now solely led by IP specialist Bárbara Sainz De Vicuña, following the departure of former co-head Isabela Crespo in October 2025.

Praxisleiter:

Bárbara Sainz de Vicuña


Referenzen

‘Knowledge, flexibility, adaptation to the business, speed.’

Highlight-Mandate


Osborne Clarke

Acting for an array of domestic and international clients, the data privacy and data protection team at Osborne Clarke possesses extensive expertise advising on the management of data breaches and cyber attacks, and the development of data protection policies. Practice head Rafael García del Poyo regularly works with clients from the TMT, automotive, and retail sectors, while Roger Segarra has an established practice advising on data protection and privacy policies regarding data transfers and cloud computing.

Praxisleiter:

Rafael García del Poyo


Weitere Kernanwälte:

Roger Segarra; Mario Gras; Paula Grifols


Kernmandanten

Grifols


Telefèric Group


Citibox Smart Services, S.L.


The GB Foods


Grifols


Telefèric Group


Citibox Smart Services, S.L.


The GB Foods


Highlight-Mandate


  • Advising Grifols on the data protection implications of recording and transcription functionalities within chat messaging applications.
  • Assisted Citibox with the design and execution of the changes in the personal data flows as a consequence of the corporate restructuring undertaken as a condition of the financing obtained.