Next Generation Partners

Firms To Watch: Data privacy and data protection

Elzaburu has an active partner in Ruth Benito Martín, who specialises in personal data privacy and protection. Her work encompasses data protection impact assessments, risk analysis, regulatory and contentious matters.
Osborne Clarke is increasingly visible in matters concerting data privacy and the response to potential data breaches. Lead partner Rafael Garcia Del Poyo in Madrid is frequently involved in EU landmark cases before the Court of Justice of the European Union on legitimate interest, and is a key adviser to corporates on digital transformation projects.
Santiago Mediano Abogados frequently handles data protection audits, actions before the Spanish Data Protection Agency, and responses to security breaches. It also performs the role of Data Privacy Officer (DPO) for numerous clients, among them blue-chip companies from diverse sectors including media, technology, software, e-commerce, and telecoms.

Data privacy and data protection in Spain


What really sets it apart is its innovative approach‘, say clients of ECIJA , where the privacy and data protection group is part of a market-leading TMT practice. Managing partner Alejandro Touriño is a standout practitioner in matters of IP and new technologies, while up-and-coming partners Jesús Yáñez, Daniel López – who has ‘great knowledge of the subject‘ – and Teresa Pereyra are highly experienced in compliance matters and are key advisers on regulatory developments. Barcelona-based Vanesa Alarcón regularly advises domestic and international clients on data protection and privacy, IT services and e-commerce matters.

Other key lawyers:

Alejandro Touriño; Daniel López; Vanesa Alarcón; Teresa Pereyra; Jesús Yáñez; Esperanza López


‘The service provided by ECIJA in terms of protection makes it different, due to the knowledge brought to the market, interrelation with other practice areas and their applicable regulations, along with the evolution of the model and the application of new technologies. Strong response times and availability, both at the partner and assigned team level.’

‘I would highlight the team’s great knowledge of the subject and other applicable regulations, an aspect that is relevant taking into account the activity carried out by us, the adaptation of new technologies, artificial intelligence models and the evolution of the sector itself. Work is completed with practical knowledge, tailored to our needs, both at the national, European and international level. Knowledge, closeness and availability, ability to adapt to needs, times and risks, together with the proactive approach to compliance. Without a doubt, a safe proposition.’

‘What really sets ECIJA apart is its innovative approach. In a constantly evolving legal world, ECIJA not only keeps up with changes, but is also at the forefront of finding creative solutions for their clients. Their innovative mindset is reflected in the way they approach cases and their willingness to explore new legal strategies to achieve exceptional results. Despite its success and growth, ECIJA maintains personalised attention to its clients. In my experience, I always felt like a priority, with a legal team that communicated proactively and kept me constantly informed. ECIJA is an exceptionally talented and highly innovative team that exceeds all expectations.’

‘The culture, the talent of each person on the team, and the communication is what I value most. From partners to junior associates, each attorney demonstrates deep knowledge in their field of expertise, has an enviable dedication to keeping up with the latest legal trends, and their ability to apply that knowledge to complex cases is truly impressive.’

‘I highlight two strong points. Firstly, the level of specialisation of its work team, which allows us to address complex issues from a not only technical but organisational/functional point of view, and secondly, the level of attention,  flexibility and client service.’

‘The work team that collaborates with us has a very high level of knowledge that allows us not only to delve deeper into each of the areas, but also to apply a transversal criterion to the responses, considering the technological and innovative component, as well as other closely related disciplines. Without a doubt, it is of high added value to have specialists who take into account a comprehensive vision of the case.’

‘Regarding the quality of the work results, all responses incorporate a contextual interpretation based on solid arguments and, when required, provide additional relevant documents or information that is very useful for its application in practice. The contribution of technical criteria adapted to the specific case is of clear added value, which provides a very useful and didactic practical vision in the implementation with other areas or departments.’

‘They insist on looking for alternatives and foundations to defend the interests of my company and at the same time they are practical and straightforward when it comes to assessing the possibilities of success or failure of a certain legal strategy, based on the particularities of the case and their experience.’

Key clients


World Bank



La Liga

Bank Of Spain

ACB (National Basketball League)

Inditex (Zara, Pull & Bear, Massimo Dutti, Bershka, Etc.)


Momenta Europe Gmbh

Zur Rose

Santander Bank

Ing Bank


Aena Airport Network

Aquila Capital

Publicis Groupe

Iberia Airlines

Vueling Airlines

Latam Airlines

Barcelona Football Club


Bupa Group (Sanitas)




NH Hotels

Melia Hotels

Bnp Paribas




Dorna Sports (Moto Gp)





Philip Morris

Hearst Magazines

La Prairie






Havas Media







Goiko Grill


Work highlights

  • Advised Inditex on IT and data privacy matters and provided strategic guidance on the impact of new tools and campaigns across Inditex’s brands.
  • Providing ongoing advice to McDonald’s on data privacy and protection matters.
  • Advised Making Science and Google on data monetisation and cookie use while ensuring compliance with data protection regulations.


The data protection, privacy, cybersecurity and technology practice at Garrigues is ‘up-to-date and very efficient, rigorous and compliant‘. Clients praise practice head Alejandro Padín and senior associate Katiana Otero as ‘upright lawyers who look after the interests of their clients with great knowledge and empathy‘. The firm handles data economy matters, including data monetisation projects, as well as regulatory issues concerning data privacy and cybersecurity, either in preparation for cyberattacks or as an incident response team. Padín and senior associate Álvaro Blanco assist major multinationals with day-to-day data protection matters, including the drafting and negotiation of international data transfer agreements with service providers.

Practice head(s):

Alejandro Padín

Other key lawyers:

Katiana Otero; Álvaro Blanco


‘I really like how they work. They are always ready.’

‘The Garrigues team is up-to-date and very efficient. Rigorous and compliant.’

‘They are upright lawyers who look after the interests of their clients with great knowledge and empathy.’

‘Alejandro Padín is very responsive, understated, and maintains good connections with authorities. Gets the job done and always with no fuss.’

Key clients

Philip Morris Spain

Bip&Drive, E.d.e. S.a.

Unidad Oftalmológica Balear (Grupo Miranza)

L’oréal España, S.a.u.

Vocento S.a. (Grupo Vocento)

Carrefour Group

Hyundai Motor España

Lopesan Group

Jazz Pharmaceuticals

Samsung Iberia, S.a.u.

Work highlights

Hogan Lovells International LLP

Hogan Lovells International LLP has a prominent position in the market, recommended ‘not only for its knowledge of regulations in force and being developed by regulators, but also for its ability to adapt advice to the client’s practical needs‘. Furthermore, it is ‘well resourced to support blue-chip instructions‘, counting Google and Applied Therapeutics among its clients. The ‘exceptionalGonzalo F. Gállego is backed by a team of skilled associates, among them commercial IP and IT specialist Juan Ramón Robles, who advises on the design of policies and procedures for e-commerce platforms, and senior associate Santiago De Ampuero Castellanos, who frequently assists local and international companies in dealings with the Spanish Data Protection Agency. Associate Clara Lázaro focuses on e-commerce and commercial advertising matters.

Practice head(s):

Gonzalo Gállego

Other key lawyers:

Santiago de Ampuero Castellanos; Juan Ramón Robles; Clara Lázaro


‘The team led by Gonzalo Gállego is excellent, not only for its knowledge of the regulations in force and those being developed and executed by regulators, but also for its ability to adapt advice to the client’s practical needs.’

‘Gonzalo Gállego is exceptional in his total availability, immediate response and empathy. He combines a very high level of knowledge with a pragmatic and empathetic vision for the client, providing solutions that work in practice and mitigate risks. His leadership and treatment of his team is equally commendable.’

‘It is an exceptional team, the best in the market. Always available at any time. Unbeatable treatment.’

‘Of the firms that we have contacted in Spain to carry out the Binding Corporate Rules and Artificial Intelligence issues, they are the only ones that have given us complete and detailed information on the process. At the billing level we made a payment plan and they showed flexibility. As a client we have the certainty and confidence of being well advised and in the best hands.’

‘The service provided by Gonzalo Gállego’s team is superior to that of other firms that we have contacted in Spain and Europe. He and his team stand out for their speed of response and knowledge of the topics. Gonzalo’s friendliness and excellent personal treatment make him and his team one of absolute excellence.’

‘Great knowledge and experience in the subject, with an international vision that other firms do not provide. Agility in advice and flexibility in the search for imaginative solutions.’

‘The team has excellent market insights and is well resourced to support blue-chip instructions.’

‘Gonzalo Gállego is excellent with key stakeholders and can navigate the politics of big business with ease. Santiago de Ampuero Castellanos is a terrific support and together they make an excellent team.’

Key clients



Applied Therapeutics

Work highlights

Baker McKenzie

Baker McKenzie has a multidisciplinary team featuring IP and technology expertise, as well as showcasing ‘extensive experience and knowledge in the field of data protection‘. Acting for an impressive roster of domestic and international companies, the group handles regulatory matters, GDPR and privacy issues, content moderation, e-commerce, data protection, and contentious matters heard before the Spanish Data Protection Supervisory Authority. The practice is led by José María Méndez in Madrid and IP partner Cristina Duch in Barcelona, while associate Patricia Pérez is a key adviser on licensing and outsourcing agreements. ‘They get personally involved in the project, as if it were their own project‘, notes one client.

Practice head(s):

José María Méndez; Cristina Duch

Other key lawyers:

Patricia Pérez; Pablo Uslé


‘The team has great knowledge and the international group is allowing clients to get more detailed information and assistance worldwide. The difference between Baker McKenzie and others is the network and the ability to give replies and assistance related to different countries.’

‘They are all very kind and professional.’

‘The team has extensive experience in international affairs, in projects and consultations affecting multiple jurisdictions.’

Work highlights

Bird & Bird

Bird & Bird‘s privacy and data protection practice has a strong position in cross-border matters, drawing on its extensive office network across Europe, Africa, the Middle East, Asia Pacific and North America. Clients praise the ‘flexible and business-oriented‘ practice for its ‘extensive experience in solving the most complex issues‘. Lead partner Joaquin Muñoz is a key adviser to international corporations on regulatory and compliance matters, working with major data platform companies on business-critical aspects of GDPR rules. Associate Paula Garralón stands out for her in-depth knowledge of cross-border personal data transfers and the management of data breaches.

Practice head(s):

Joaquín Muñoz

Other key lawyers:

Paula Garralón; Mar Ibánez; Alvaro Vidal


‘What differentiates them is their proactivity toward each of the companies they advise. Specifically, knowing in detail the services provided, analysing possible alternatives and solutions, and the impact on the various areas of the company. Strong availability when urgent issues require support outside of working hours.’

‘Joaquín Muñoz possesses a high degree of client service, in relation to both the service provided and the timing, as well as deep knowledge of the area on which he advises. Furthermore, he is able to offer an optimal and quality solution, free of legal jargon for non-experts.’

‘Bird & Bird offers us data protection, compliance and NNTT services. It is a young, well-trained team that knows our copyright management sector. They adapt to our needs and give us a quick response to our requirements.’

‘Joaquin Muñoz, partner of the firm, is personally involved in our issues and leads a highly qualified team. They always seek to give us a solution to the problems raised.’

‘This is a team with very varied and carefully selected profiles. The solutions they offer to complex problems are underpinned by efforts to continuously update knowledge and extensive experience in solving the most complex issues.’

‘The team led by Joaquín Muñoz, which includes Paula Garralón and Mar Ibánez, has a solid vision of compliance with privacy regulations, in addition to being sufficiently sensitive to business needs. High performance and continuous updating of new knowledge represent a great contribution to making the most complex issues simpler.’

‘Close to the business, very good lawyers, creative, reasonable cost. They have introduced a platform so that the client can see the matters managed by the firm.’

‘They are close, flexible and business-oriented.’

Key clients


Tendam Retail, S. A.

Work highlights

  • Advising Hocelot on the legal consequences of the entry into force of GDPR and other compliance obligations with business-critical implications.
  • Acting for Tendam Retail SA as its external data protection officer, advising on the signing of contracts with different suppliers.

CMS Albiñana y Suárez de Lezo

CMS Albiñana y Suárez de Lezo‘s Madrid-based data protection practice is a key adviser to numerous Spanish blue-chip companies and international technology businesses on contentious instructions and regulatory matters, in addition to providing day-to-day advice on data issues. Practice head and global head of communications Javier Torre de Silva, who is best known for his expertise in telecoms regulation, works closely with associate Miguel Recio in key contentious matters. Counsel José Luis Piñar is well regarded by clients and peers alike for his ‘privileged understanding of the regulations and the initiatives of the different European supervisors, as well as the discussions and values ​​that led to their implementation‘. He is currently part of a working group drafting Spain’s Digital Rights Charter.

Practice head(s):

Javier Torre de Silva

Other key lawyers:

José Luis Piñar; Miguel Recio


‘José Luis Piñar is truly part of your team in matters of data protection and has a privileged understanding of both the regulations and the initiatives of the different European supervisors, as well as the discussions and values ​​that led to their implementation.’

‘I would like to highlight Javier Torre de Silva, who has an unusual knowledge among lawyers of current technology and an open mind when it comes to seeking tailored solutions for the particularities of each client.’

Key clients

Caixabank / Caixabank Payments and Consumer, EFC, EP, SAU

Ferrovial Group

Amazon and Amazon Web Services

Commerzbank AG

SoftwareOne Spain

Techem Energy Services SL

Celine (LVMH Group)


Sending Transporte y Comunicación

Credit Agricole




Iberia Cards

IP Belgian Services Company SRL (iPaper)

Neoelectra Energía

Savills Investment Management




Work highlights

  • Represented and defended Spanish bank CaixaBank in court proceedings initiated to challenge the Spanish Data Protection Authority’s decision imposing a fine of €6m and the obligation to adapt its internal procedures and protocols.

Ramón y Cajal Abogados

At Ramón y Cajal Abogados, ‘the advice and cooperation is very client-oriented, and in addition to profound professional knowledge, the team also offers creative solutions‘. The TMT and data protection group handles a vast range of work, covering cybersecurity, e-business, online gaming, IT contracts, outsourcing projects, compliance, and cloud computing issues. ‘Friendly and sympathetic‘ lead partner Norman Heckhdemonstrates a very high level of professional competence and detailed knowledge‘. Senior associate María Luisa González also plays a pivotal role in advising key clients of the firm.

Practice head(s):

Norman Heckh

Other key lawyers:

María Luisa González


‘The team is characterised by a high level of professional competence, especially on new topics such as the Whistleblower Protection Act. Communication is very efficient. The advice and cooperation is very client-oriented. In addition to profound professional knowledge, the team also offers creative solutions.’

‘Normen Heckh has a very friendly, sympathetic manner, which makes the cooperation very pleasant. In addition, he demonstrates a very high level of professional competence and detailed knowledge, so you feel you are in good hands.’

‘Norman and his team have demonstrated great responsiveness, reliability and provision of legal advice from a pragmatic perspective, with excellent legal knowledge and understanding of business and the sector, particularly in technology, privacy and new trends such as AI. In comparison with other firms, I would highlight their proactivity in the analysis of new regulations and trends.’

‘I work mainly with Norman Heckh. Always available and gives advice that is not only in accordance with the law, but manageable from a business point of view, with common sense, seeking to fit the way of work and organisation of the company. In addition to Norman, I would highlight his senior associate, María Luisa González, who has some of the greatest skills in data protection and privacy of any lawyer in Spain.’

‘A strong team with a commercial, practical approach to providing clients with legal advice. Not easy to find in the Spanish legal market.’

‘Norman Heckh is a standout leader in his practice area. Responsive, commercial and practical. He does not lose sight of the issues that are critical to clients to resolve.’

‘Great team, very knowledgeable and great value added. Norman Heckh is the lead partner.’

‘A multidisciplinary team that supports each other to solve client problems.’

Key clients


Reef Technology

Instituto de Contabilidad y Auditoría de Cuentasde España -ICAC



Haya Real State


Zimmer Biomet




Palo Alto Networks


Network Steel Group



Enjoy Zaragoza



Iberdrola Inmobiliaria


Sonae Sierra

Siemens Healthcare


Iberia Express

General Optica






Siemens Healthcare


Work highlights

  • Advised REEF on the set up of a black kitchen project in Spain in joint venture with CEPSA, having defined and implemented all legal e-commerce requirements, including website terms, terms and conditions, and e-marketing.
  • Advised Logista on a comprehensive data protection review of all the processes of the company.
  • Advised Telefónica on the acquisition of a sophisticated cybersecurity entity.

Uría Menéndez

Uría Menéndez has a stellar roster of clients, who turn to the firm for ‘the quality of the responses and understanding of the client’s needs‘ in data protection matters. Practice head Leticia López-Lapuente is highly regarded by peers and clients alike, garnering praise for her ‘practical knowledge and experience‘. She frequently assists a major multinational social media company with privacy and digital matters – including data protection, cookies and social networks – and offers representation in proceedings before the Spanish Data Protection Authority. Counsel Francisco Javier García also plays a key role in advising clients in the pharmaceutical, tobacco, e-commerce, IoT, software, cosmetics and fashion industries on privacy matters.

Practice head(s):

Leticia López-Lapuente

Other key lawyers:

Francisco Javier García


‘Uría Menéndez provides solutions to the issues raised and respects the necessary deadlines. The team also stands out in the quality of the responses and understanding of the client’s needs. Although the queries have a high technical component, they seek related information and support in other areas to be able to respond to the questions outside their area of ​​knowledge and specialisation.’

‘I would highlight their kindness and the time they dedicate to understanding, listening to needs and thus being able to provide an appropriate solution and documentation. It is also worth recognising their effort to educate and make the client understand their explanations and point of view.’

‘Very solid, flexible team that understands the needs of the business.’

‘Knowledge of the business, high levels of involvement, and they provide practical solutions adapted to the needs of the client.’

‘The Uría Menéndez team is especially suitable for advice on data protection due to its speed, practical application of advice, and technological knowledge.’

‘I would highlight Leticia López-Lapuente for her practical knowledge and experience.’

Key clients








Banco Santander Group




General Logistic Systems (GLS)

El Corte Inglés


Banco de Sabadell




Johnson & Johnson

Work highlights

  • Strategic advice to the Santander Group on a global scale regarding its privacy terms and specific review of contractual mechanisms for international transfers of personal data with its key vendors.
  • Providing daily advice to the Meta Group (Facebook, Instagram, WhatsApp, Oculus, Metaverse, and other products) regarding privacy matters and on the group’s cases with the Spanish Data Protection Agency and users.
  • Advising Twitter on all its key privacy matters in Spain, including dealing with authorities such as the Spanish Data Protection Agency (AEPD).


Andersen, which draws on a substantial network of lawyers across its offices in Madrid, Barcelona, Valencia and Seville, stands out for IT and digitalisation projects, for which it blends expertise in data privacy, digital business, regulatory, and IP law. Clients praise ‘its ability to find the best solution to the problems raised in an agile and effective way‘. Lead partner Isabel Martínez Moriel is experienced in data protection, privacy, IT and competition law. Associate María Zarzalejos, who focuses on commercial and regulatory matters, and corporate partner María Suárez, who handles data protection audits and due diligence projects, also play key roles in the practice.

Practice head(s):

Isabel Martínez Moriel

Other key lawyers:

María Zarzalejos; María Suárez; Miriam Romano


‘The team has a great command of the subject and are very decisive. They always know how to adapt and find the fit between their recommendations and the needs of the business.’

‘Isabel Martínez Moriel, María Zarzalejos and Miriam Romano are tireless workers, always willing to help and give their best. They have vast knowledge of the subject, and they always have a friendly and very professional manner.’

‘The best thing about the Andersen data privacy team is its ability to find the best solution to the problems raised in an agile and effective way. They have a fine-tuned working sensibility and manage to perfectly understand the needs we have as a client.’

‘In addition to great interpersonal skills, they are unsurpassed professionals. They have very deep knowledge of the area they work in.’

‘Great communication, collaboration, and availability. They are involved in the projects, flexible and adapt to the client, demonstrating great knowledge of the subject, and offering prices consistent with the work performed.’

‘Isabel Martínez Moriel is personable with great knowledge, a dynamic sensibility, and a great team around her.’

‘They make the effort to study complex topics and provide practical solutions. Strong availability and effort to know the client’s sector. Try to anticipate problems and risks. They exude the qualities of teamwork and internal camaraderie. Also noteworthy is their knowledge of technology and its practical application.’

‘I would highlight their accessibility and flexibility when approaching projects.’

Key clients

Encore Capital Group

Insud Pharma Group

Medinsa And Aristo Pharma Iberia



Iberia Cards

Tonic App


Work highlights

  • Advised Encore Group on several data and privacy matters, such as the data protection issues in Spain and Luxembourg before data protection authorities or the launch of a new app development outside EEA regarding international data flows.
  • Advised Insud Pharma in relation to several data protection and privacy issues, giving support to the global DPO.
  • Advised Heineken on the implementation of privacy and IT global projects, taking into consideration data protection aspects worldwide as well as local aspects.


Audens, which has offices in Madrid and Bilbao, is a boutique firm focused on – among other areas – privacy, data protection and technology law. The firm acts as data protection officer for numerous clients, and also handles data protection audits and the defence of contentious matters in disciplinary proceedings with the Spanish Data Protection Agency. The lead partners are Marcos Judel, who has ‘exceptional strategic and overall vision‘, and Leandro Núñez, who has ‘exceptional knowledge both at a theoretical and an implementation level‘. Senior associate Héctor Oliver Almeida, who handles data compliance and cyber law, is ‘able to convey incredibly complex issues in just a few words‘.

Practice head(s):

Marcos Judel; Leandro Núñez

Other key lawyers:

Héctor Oliver Almeida


‘It is a very active, modern firm, adapted to new times and technologies with great reporting systems and quality of service.’

‘Dedication and client service, immediacy, closeness and professionalism.’

‘Audens cares about knowing the client’s business and giving you solutions so as not to paralyse said business.’

Key clients

Banco Sabadell


Galp Energia Spain

Cámara de Comercio de España

GMV Innovating Solutions

Vorwerk España

Entidad Nacional de Acreditación – ENAC (“Spanish Accreditation Body”)



Work highlights

  • Advised Banco Sabadell on directing and carrying out the legal defence before the courts of various civil lawsuits in relation to the inclusion in the entity’s solvency files of people who have a debt with the entity.
  • Advised Másmovil on a strategic plan to adapt all its websites to the GDPR and on the verification of compliance.
  • Advised Galp Energia Spain, S.A.U., Galpgest Petrogal Estaciones de Servicio S.L.U. and Galp Energia Independiente, S.A.U. as Data Protection Officers (DPO), locally implementing the strategic plan adaptation of their parent company in Portugal for compliance with the GDPR as well as supporting their team of Data Protection Delegate (DPD).


Cuatrecasas frequently acts as data protection officer for large corporate clients, among them Primavera Sound and Sony Music Entertainment. As well as assisting companies with day-to-day data protection advice, the firm is also helping clients adapt to the current regulations in Spain as they evolve. Counsel and practice head Alejandro Negro in Madrid stands out for regulatory advice on data protection and privacy compliance, data security breaches, investigations, and enforcement actions. Technology partner Albert Agustinoy, who is based in Barcelona, also handles data protection compliance matters as part of his broad practice. Partner Rafael Sánchez Aristi is also a key adviser on technology and digital media matters.

Practice head(s):

Alejandro Negro

Other key lawyers:

Albert Agustinoy; Rafael Sánchez Aristi

Key clients

Sony Music


Primavera Sound


Euroleague Basketball

Schneider Electric

Bansabadell Zurich

Kronos Investment Management Spain

Goal Systems

Hotel Investment Partners (HIP)

Work highlights

  • Advised Primavera Sound, as its data protection officer (DPO), on coordinating a global data protection project that involves data flows relating to the launch of its international festivals in the US, Argentina, Brazil, Chile and Portugal.
  • Advised Sony Music Entertainment as its DPO, including questions regarding data protection, privacy, cookies policies and reviewing contracts.
  • Advised Seat on adapting its policies and procedures relating to GDPR.


Praised as a firm which ‘perfectly combines technical knowledge and common sense in advice‘, Pérez-Llorca recently hired digital law expert Raúl Rubio from Deloitte Legal to lead the practice along with partner Andy Ramos Gil De La Haza. Rubio ‘stands out for his technical knowledge, practicality, creativity and ability to put himself in the shoes of an in-house lawyer‘. Associate Andrea Sánchez also plays a key role in the practice, particularly for her ability to analyse the compatibility of new technologies and algorithms with data protection regulations. Associate Antonio Muñoz-Torrero‘s experience in regulatory matters, litigation and technology procurement is a further boon to the practice.

Practice head(s):

Andy Ramos Gil De La Haza; Raúl Rubio

Other key lawyers:

Andrea Sánchez; Antonio Muñoz-Torrero


‘It is a firm that perfectly combines technical knowledge and common sense in advice. Great knowledge of the industry and the client. They advise clients on a matter that is constantly evolving so their expertise is enriching.’

‘Collaboration with Raúl Rubio is very easy for an in-house lawyer: he is always available to answer any questions and response times are very fast. I believe that what makes this practice at Pérez Llorca unique is Raúl Rubio’s technical knowledge – not only from a legal perspective but also from a technological and security perspective, which is vital when you are looking for is 360° advice. I found it extremely easy to start working with the firm – without the need for a lot of bureaucracy and being able to assist me quickly on an urgent issue.’

‘Raúl Rubio stands out compared to other partners in the sector for his technical knowledge, practicality, creativity and ability to put himself in the shoes of an in-house company lawyer.’

‘Pérez-Llorca has a data protection team in which lawyers are characterised by their very practical advice which doesn’t lose perspective on new regulations and market practices. Collaboration and communication with the team is very easy.’

‘Raúl Rubio has considerable experience in the subject which makes him very knowledgeable, but he has a very practical and grounded vision on a day-to-day basis. He is an accessible person who makes collaboration very fluid.’

‘Its multidisciplinary team allows the firm to provide very complete global advice in complex areas, such as the protection of personal data, which is so closely linked to technology. It is a firm which leads complex initiatives without fear.’

‘They provide realistic solutions, not only based on theory and always focusing on risk.’

‘Excellent professionals who design strategies to build a personalised solution, prioritising the investment of efforts in the factors with the greatest impact on the organisation.’

Work highlights

Squire Patton Boggs

Squire Patton Boggs is noted for the growing prominence of its dedicated data protection, cybersecurity and digital assets practice. The firm is praised for ‘the rigorous nature of its advice and the direct involvement of the partner‘, as well as its ‘deep understanding of technological projects‘. Lead partner Bartolome Martin, who joined from KPMG Abogados, Spain in 2022, is ‘the best privacy lawyer in Spain‘, according to one client. The work of Martin and associate Claire Murphy spans legal reports addressing data protection regulations, and dealings with the Spanish Data Protection Authority (AEPD) in the event of cyberattacks.

Practice head(s):

Bartolomé Martin

Other key lawyers:

Claire Murphy


‘Lawyers who provide practical and very useful support for my company.’

‘Bartolomé Martin is the best privacy lawyer in Spain. Every time we have a serious question, we go to him with utmost confidence. Brilliant on a technical level; a practical lawyer focused on business. ’

‘I rate Bartolomé Martin for his knowledge, his reliability, and his speed of response.’

‘Extensive knowledge of the subject, availability, patience. Compared to other firms, the attitude of the partner stands out. The advice is very precise and adjusted to the needs that arise. They focus on the client and their needs. The rigorous nature of the advice and the direct involvement of the partner is also noteworthy.’

‘Great knowledge and professional rigour. Very easy to work with, listens to the client, and takes time to get to know their needs and the internal team.’

‘Responds to queries very quickly. Attorneys within the firm from across different countries collaborate well and work together to come up with practical solutions for your company. The attorneys also offer up practical solutions based on their experience, assessing risk for your company.’

‘Bartolomé Martin provides very practical advice based on his knowledge of international data privacy law and, now that he is familiar with our business, he is able to think about the impact of certain issues or questions across the company.’

‘Bartolomé Martin is always available, understands the complexities of our projects, and provides legal advice focused on the business.’

Clifford Chance

Clifford Chance handles a strong flow of litigation and advisory work arising from data privacy regulations, including significant matters before the Spanish Data Protection Agency (AEPD). The firm is a key adviser to Centros Comerciales Carrefour and its financial division on the data protection aspects of its day-to-day activity, with practice head and former State Attorney Fernando Irurzun taking the lead. All members of the practice have a dual adviser/litigator role which is a boon to the practice’s clients, among them Vodafone, which Irurzun assisted with proceedings before the AEPD concerning international data transfers and the processing of client data for marketing purposes.

Practice head(s):

Fernando Irurzun

Key clients


Centros Comerciales Carrefour

I-DE Redes Eléctricas Inteligentes

Servicios Financieros Carrefour

Correduría de Seguros Carrefour

Stirling Square Capital Partners

Esteve Healthcare

Work highlights

  • Advised Vodafone España before the Spanish Data Protection Agency (AEPD) and the Administrative Chamber of the National Court on two contentious proceedings, initiated due to sanctions imposed in Spain by the AEPD.
  • Advised Centros Comerciales Carrefour and Servicios Financieros Carrefour in relation to all data protection aspects of its day-to-day activity.
  • Advised I-DE Redes Eléctricas Inteligentes in relation to the challenge, before the Administrative Chamber of the National Court, of the decision taken by the Spanish Data Protection Agency (AEPD), imposing a fine of €200k on I-DE Redes, due to a violation of articles 5.1.b) and c) and article 6.1.b) GDPR.

Gómez-Acebo & Pombo

Gómez-Acebo & Pombo has a ‘well-trained, very friendly team‘ whose work encompasses legal opinions on the protection of personal data, advice on the implementation of data protection protocols and policies, data protection audits, international data transfers, privacy and cookie policies, and broader cybersecurity matters. Senior associate Isabela Crespo leads the practice, with clients praising her ‘knowledge, sympathy and proactivity’. Crespo, who focuses on data protection and privacy, cybersecurity, and digital law, works closely with fellow senior associate Bárbara Sainz De Vicuña, who handles IT and IP matters.

Practice head(s):

Isabela Crespo

Other key lawyers:

Bárbara Sainz De Vicuña


‘Well-trained, very friendly team that understands the difficulties of the in-house team. Very collaborative and willing to help.’

‘In my opinion, Isabela Crespo stands out for her knowledge, sympathy and proactivity, especially during the implementation of our business group’s data protection programme.’

Work highlights

PwC Tax & Legal Services

PwC Tax & Legal Services has a wide-ranging data protection practice that handles data protection assessments, GDPR audits, privacy tool implementation, data governance matters and more. Fernando Fernandez-Miranda and his team of ‘excellent, proactive and hardworking lawyers‘ notably assisted General Electric with a strategic review of data protection matters arising from corporate spin-offs.

Practice head(s):

Fernando Fernandez-Miranda

Other key lawyers:

Fernando Herrero; Ricardo Oliván; Marta Llamazares; Pedro Gaspar


‘The PWC Data Protection team is exceptional. Their level of professionalism is excellent, and they also take maximum care of the details. It is worthy of admiration. In addition, they are very advanced on a digital level, they have many tools in terms of legal tech and artificial intelligence, being at the forefront of the sector.’

‘Pedro Gaspar’s work is exceptional. He knows the sector of my company perfectly, he masters it and in his analyses and evaluations you can clearly see the great understanding he has of our business. I can only praise his professionalism, which is always far above our expectations.’

‘The PWC team is an exceptional team that knows perfectly the sector in which it provides advice, is always up to date and perfectly directed by partner Fernando Fernandez-Miranda. Compared to other firms that are considered top of the line, the PWC team is far superior.’

Key clients

General Electric (GE)

Amazon Web Services

UBS Bank


Orange Telecom


Jaguar Land Rover


Groupe Renault

Generali Group

Rakuten TV

ENEL Group (Endesa)

Merlin Properties

Swiss Life Insurance

Laboratorios Rovi



Work highlights

  • Advised GE on data protection matters which entailed an extensive analysis of data protection regulations at an EU and international level as well as views from multiple supervisory authorities and risk-based frameworks of companies operating in multijurisdictional environments.
  • Advised Amazon Web Services on regulatory, data protection and cybersecurity matters related to its cloud-based technology activity.
  • Acts as a privacy and data protection adviser for UBS Bank, including in all data protection matters related to the sale of its wealth management business to Singular Bank in Spain.