Data privacy and data protection in Spain

Baker McKenzie

The highly regarded data protection practice at Baker McKenzie sits within the broader IT and communications department and assists multinational companies with data privacy and information management issues at a domestic and global level. Clients also benefit from several technological tools and platforms adopted by the firm, including its online GDPR Enforcement Tracker and Global Data Privacy and Security Handbook. Practice head Raúl Rubio is highlighted for his 'technological knowledge and international experience'. Associates Patricia Perez and Marta de Pablos are also noted.

Practice head(s):

Raul Rubio

Other key lawyers:

Marta de Pablos; Patricia Perez


‘It is a highly qualified team trained in matters of interest, which also has the ability to prepare well-crafted responses in very short periods of time.’

‘Strongly cohesive team. Immediate attention to the phone and although, of course, they have to study the issues that arise, they are very agile.’

‘Raul Rubio and Carmen Salazar have a fit with the internal legal team and with the business. They are not only great experts but they are able to communicate and explain the business very easily.’

‘The differential value is the knowledge that the Baker team has obtained throughout these years advising my company in different aspects, the understanding of how our business works.’

‘Raúl Rubio, the partner, for his technological knowledge and international experience, and his team, especially Patricia Pérez and Marta de Pablos, flexible, experienced professionals with great dedication to the client.’

‘Its closeness, humility, professionalism and always friendly treatment.’



ECIJA fields an 'involved team that is interested in offering complete advice and providing solutions and alternatives that fit the business needs'. The sizeable department counts household name companies among its clients, including leading players in the telecoms and life sciences sectors. In 2019, the firm launched ECIJA Tech, which provides legaltech solutions to clients and assists them in the digitalisation of their legal departments. Managing partner Alejandro TouriñoSalvador Silvestre and Daniel López are among the partners singled out for praise. At the associate level, Esperanza López, Javier Arnáiz and Cristina Martínez Garay are also noted.

Other key lawyers:

Alejandro Touriño; Alonso Hurtado; María González; Salvador Silvestre; Cristina Villasante; Daniel López; Cristina Martínez Garay; Jesús Yáñez; Carlos Pérez; Esperanza López; Javier Arnaiz; Joaquín Cives


‘In our opinion, it is a team with a high level of: Professionalism, knowledge, dedication, thoroughness, experience, highly trained work team, teamwork, customer orientation, availability.’

‘In-depth knowledge of the subject, knowledge of the sector to which my company and my company belong, closeness in the treatment and speed to receive their input on questions that I ask them. In addition, they are clear and concrete when they respond to the issues that we transfer to them, always proposing solutions. They are the reference office in this matter.’

‘ECIJA’s privacy and data protection team demonstrates a great knowledge of this area of practice, seeking innovative solutions to the new challenges that arise in the company. Its strengths include its legal and technical knowledge, its knowledge of the activity sector and the different applicable regulations, as well as the markets in which it operates. Work methodology aimed at solving day-to-day issues of the company, obtaining results and facilitating a compliance framework. Teamwork between in-house lawyers and ECIJA professionals, very close and accessible. We believe that the firm leads the legal sector in this area of practice.’

‘They have professionals of recognized prestige in the sector, highlighting their professionalism and human quality. Great specialists in the field of the Data Protection standard in its broadest sense, striving to know the particularities of the business of their clients, so that they always try to apply that technical knowledge in effective solutions useful for decision-making, being their solid and judicious arguments. Likewise, it is necessary to highlight the conciliatory character, honesty and their ability to communicate, being very enriching to work with them.’

‘It is worth highlighting the work and involvement in this regard of Daniel López as Partner of the Privacy Area and Alejandro Touriño as Managing Partner and Partner of the Information Technology Area. We must highlight their international positioning as references in this area, close to institutions and organizations in this field of law, both in Spain and in other countries. Both have a great team of professionals, among which Esperanza López and Javier Arnaiz stand out as Senior Associates.’

‘Salvador Silvestre, Cristina Martínez and Marta Granell have been great professionals, providing support at all times, motivating their positions and helping to achieve the projects.’

‘The route, proactivity, availability, know-how and closeness to the client are its hallmarks. Particularly from the partner we work with: Salvador Silvestre.’

‘You feel that you are working with someone internal and not external. They are one of the team. They do not limit themselves to giving legal advice but they look for alternatives to see how you can implement it in your business and in that specific case. In our case, I would like to highlight Alonso Hurtado, Maria Gonzalez, Dmitry Alekseev and Joaquín Cives Leis.’

Key clients

World Bank

Bank Of Spain


Santander Bank






Minor Hotels

Melia Hotel Group

Teva Pharma

Roche Pharma



BNP Paribas

Colt Telecom

University Of Navarra




Euro 6000

National Post (Correos)




Wolters Kluwer

Latam Airlines


Philip Morris

Hearst Group




Work highlights

  • Advised the Bank of Spain in the definition of the strategy of adaptation to the European and Spanish regulations on data protection while complying with other economic, labour, tax and security regulations.
  • Provided legal assistance in data privacy and data protection to MCDONALD’S SPAIN in the launching of its official app in Spain.
  • Advised PHILIP MORRIS in data privacy and data protection as a Data Protection Officer (DPO) in Spain to comply with the Regulation (EU) 2016/679 of the European Parliament.


The data protection and privacy lawyers at Garrigues are 'flexible and innovative to find solutions to the needs of the company'. The team is led by well-regarded partner Alejandro Padín and regularly advises clients on the data aspects of new projects, apps and platforms. Also of note is the firm's participation in the working group led by the Spanish Data Protection Agency (SDPA) and The Foundation for Research in Law and Business (FIDE) in the preparation of the new Spanish data protection law following GDPR. Katiana Otero and Sandra López are names to note at the senior associate level.

Practice head(s):

Alejandro Padín

Other key lawyers:

Katiana Otero; Sandra López; José Ramón Morales; Javier Marzo; Álvaro Blanco


The Garrigues Data privacy and data protection team is made up of excellent professionals and they have been key to the success of the initiatives that we have undertaken in this area during the 2020 financial year. As strengths, I would highlight their great knowledge and experience in the matter, the ability to understand our needs as a client and the courage and openness to undertake innovative projects in the field of Open Data.

Much of the work carried out by Garrigues for us has been pioneering in Spain. This has required that the Garrigues team had to investigate and interpret the recently enacted regulations and, most valuable, it has required that they define Best Practices in a field as innovative and up-to-date as Open Data in the Health Sector Based on the work carried out, we can affirm that Garrigues has positioned itself as a benchmark in this field in comparison with other firms.’

The people who make up the Garrigues work team stand out for their great dedication to customer service, for the rigor of their work and for their accessibility and close treatment. One of their best qualities is their willingness to listen to the customer and to look for alternatives and solutions to the challenges that arise. I take this opportunity to congratulate the following people from the Garrigues team for their excellent work and dedication: Alejandro Padín, Katiana Otero Saavedra.’

They are flexible and innovative to find solutions to the needs of the company.’

Katiana Otero transmits a lot of technical solidity and “speaks” the language of business that is very appreciated by all the teams.

Alejandro Padín, and Álvaro Blanco, were always willing and collaborative. I think their work was outstanding in every way.’

Excellent knowledge of the sector and very competent professionals.’

Expert lawyers in all areas.’

Key clients

APD (Association for the Development of Management)











Deutsche Bank

Estée Lauder


Foundation 29



Work highlights

  • Advised Santander to develop the intra-group global Covid-19 app.
  • Advised BBVA in the privacy structure of its joint venture with Allianz to develop data-based projects.
  • Provided advice on the creation of the HealthData 29 project, an open data project using health data to promote research, mainly related to rare diseases.

Hogan Lovells International LLP

Noted for its 'very practical approach', Hogan Lovells International LLP is able to 'take into account multiple jurisdictions and arrive at a global practical solution'. The firm stands out for its longstanding expertise in data privacy and cybersecurity in Spain and globally; in Madrid, the team continues to attract new clients from various industries while also maintaining its established client base. During the coronavirus crisis of 2020, a group of data protection counsels and associates from 15 jurisdictions launched a Covid-19 Exit Strategy Guide to assist businesses in managing privacy and cybersecurity issues thrown up by the pandemic. Gonzalo F Gállego is highly regarded, as are associates Clara Lázaro, Juan Ramón Robles and Laur Badin.

Practice head(s):

Gonzalo F Gállego

Other key lawyers:

Clara Lázaro; Juan Ramón Robles; Laur Badin; Víctor Mella; Santiago de Ampuero


‘The Hogan Lovells team with which my entity is working on Data Protection (led by Gonzalo F Gállego) is a team with quality training, great experience in the sector, especially in a matter as complex as regulation of International Transfers of Personal Data, experience that is difficult to find in other firms.’

‘Of the team leader, Gonzalo F Gállego, I would highlight his solid knowledge in the subjects, his intelligence and mental quickness, his involvement and, above all, his empathy with the client, to recommend the best possible solution within the specific characteristics of the client entity to which he advises. He is a person of great accessibility, despite the large amount of work and talent he has. I would always recommend your advice without any hesitation.’

‘Undoubtedly the commercial and practical vision of the application of data protection regulations and the ability to put the regulation in context, taking into account the business model, the company’s operational model and its technological capabilities. It is easy to refer to the technical aspects of a regulation, but extremely complex to apply them to a changing reality where resources and budgets are limited.’

‘Gonzalo F Gallego’s availability and proximity is very noteworthy. He is always available, he understands very well the urgent need of companies and that we have to make quick decisions and be able to understand the real risks, not the potential risk.’

‘Passion for the subject, willingness to learn how our company operates and offer practical solutions. It’s easy to be compliant in theory but what matters to us is how we can practically fulfill our legal obligations while still promoting innovations particularly in a challenging environment created by the Covid-19 pandemic.’

‘We work with Clara Lázaro who is extremely passionate about Privacy, willing to get into the trenches within our business to understand the issues that her clients are facing and get innovative in finding practical solutions. Clara has worked on some truly complex projects at an EU institutional level.’

‘Gonzalo F Gállego, the partner, has been at the forefront of the analysis and review of the deliverables at all times in order to ensure their quality and understanding. His team, Juan Ramón Robles, very technically reliable and with great communication skills towards the client.’

‘They stand out for their knowledge, the search for solutions, the business orientation away from a position of mere compliance normative, the close collaboration and ease of contact. Even though I know the entire team is noteworthy, because we have collaborated more closely with them, I would like to mention the Team Leader, Gonzalo F Gállego, who is one of the best (if not the best) in this matter. And within his team Juan Ramón Robles, Víctor Mella and Santiago de Ampuero.’

Key clients




Fomento de Construcciones y Contratas (FCC)



Work highlights

  • Advised Spanish multinational Fomento de Construcciones y Contratas (FCC) on the process of obtaining controller and processor Binding Corporate Rules (BCRs) for the group.
  • Provides global support to the Applus+ group in Spain and other countries, on GDPR compliance and local data protection requirements.

Ramón y Cajal Abogados

Ramón y Cajal Abogados 'continuously and precisely monitors the client's internal needs, perceiving in advance the possible risks that may arise in relation to compliance with the data protection regulations'. The team acts as external Data Protection Officer (DPO) for clients, and also assists DPOs and compliance officers on data privacy matters. Norman Heckh leads the practice, which includes key senior associate María Luisa González, and was further bolstered by the arrival of Pablo Tena, who re-joined the firm from an in-house position with fintech bank N26.

Practice head(s):

Norman Heckh

Other key lawyers:

María Luisa González; Pablo Tena; Antonio Borjas


‘Ramón y Cajal’s team is a highly dedicated team. They perfectly understand the needs of the business. All team members are fully available and accommodate a variety of schedules.’

‘Norman Heckh is one of the best data protection lawyers in Spain, backed by many years of experience in different firms. Norman is a deep expert of the Law but at the same time an extremely pragmatic lawyer who listens carefully to his clients. A great communicator on the subject.’

‘We work mainly with María Luisa González and with Norman Heckh, their availability and empathy (in the sense of putting themselves in the client’s situation) is excellent in my appreciation.’

‘The area of data privacy and data protection, although it emanates from legal requirements, such as GDPR, LOPDGDD, LSSI among others, requires multidisciplinary skills and resources in the technological field, information security, and process analysis capabilities in the Business. RyC has the necessary capacities, and where it does not arrive with internal resources, it knows how to surround itself with external collaborators specialized in these not so legal areas. This makes their advice and input very comprehensive.’

‘Mr. Norman Heckh and Ms. Maria Luisa González: Their preparation in the field is exceptional both nationally and internationally. Compared to its competitors, customer service is very close and they always find a tailor-made solution for all types of problems. The qualities, in addition to the professionalism, are the immediate availability and closeness.’

‘Agility. Deep knowledge. Practical application. Maria Luisa Gonzalez Tapia: excellent lawyer with extensive knowledge in all fields of LOPD practice. Antonio Borjas: excellent advisor in IT matters.’

‘The team led by Norman Heckh continuously and precisely monitors the client’s internal needs, perceiving in advance the possible risks that may arise in relation to compliance with data protection regulations. Another strong point is his knowledge of the operation of the Spanish supervisor, the Data Protection Agency, providing valuable information so that the internal legal advice can make decisions in good time.’

‘I would highlight its deep expertise on the subject and anticipation of the client’s needs. Norman Heckh as practice leader, and María Luisa González as “Associate to Watch” have given us an outstanding service in the review of data protection clauses and in the early detection of possible risks in compliance with the European Protection Regulation of data.’

Key clients


Warner Media


Spanish International Cooperation Agency


Siemens Healthcare

De Cecco

Marketing VF Limited

EDH Group



Vueling (IAG Group)

Iberia Express (IAG Group)

Level (IAG Group)

Aeléc (Spanish Electric Energy Association)

Gesternova Energía

Redexis Gas

General Optica


SoYou (Joint venture Bankia-Crédit Agricole)

Casa América

Sek Schools

Haya Real Estate

Network Steel Resources




Credit Suisse

Sonae Sierra

Work highlights

  • Provides full-service, complex data protection advice to one of the largest European media groups, having acted as external Data Protection Officer for various entities of the Group in Spain and other EU jurisdictions.
  • Conducting a global GDPR compliance programme, both from a legal and technical security perspective, in one of the most active Spanish international public organisms, with activities in a large number of jurisdictions.
  • Continues to act as advisors to the BMW Group in Spain in various data protection matters, supporting the DPO. Advice includes privacy impact assessments, marketing campaigns and contract negotiations.

Uría Menéndez

Leading companies in the technology, telecoms, social media and financial services sectors turn to Uría Menéndez's privacy and data protection team, which is ably led by Leticia López-Lapuente. The team remains busy advising clients on the data privacy aspects of new digital platforms and tools, and has also seen an uptick in cybersecurity work. The firm stands out for its longstanding expertise in the field of data privacy, as well as for its pro bono work, which includes the provision of privacy training to NGOs and foundations. In 2019, associate Reyes Bermejo Bosch was re-elected to the board of directors of the Spanish privacy association (APEP).

Practice head(s):

Leticia López-Lapuente

Other key lawyers:

Nuria Porxas; Reyes Bermejo Bosch; Laia Reyes Rico; Ana Irune Lamela


‘Uría has a cohesive team that works wonders. They are great professionals and decisive people who provide exceptional service.’

‘People make organizations. At Uría, the people who make it up meet the highest standards.’

Key clients





Banco Santander





Linea Directa




Work highlights

  • Provides Facebook and its group of companies in Spain, the EU, the UK and the US with day-to-day and strategic advice on its privacy and data-protection matters, investigations and strategy, including the launching of disruptive products and services in the EU market.
  • Advises the Banco Santander group on its worldwide strategy and terms on privacy, data protection and cybersecurity of its cloud-based systems and in connection with its relationship with cloud providers.
  • Provides Microsoft with both day-to-day advice on privacy matters (regarding privacy policies or users rights) and strategic advice on key and disruptive projects, such as cybersecurity initiatives, AI tools and key contracts.


At specialised data protection, technology and advertising law firm Audens, 'the team is made up of top-level professionals in the sector, prioritising the principles of simplicity, transparency and excellence in advice'. The team is jointly led by highly regarded partners Leandro Núñez and Marcos Judel and provides advice on a broad range of matters connected with data privacy and protection. Clients are also able to avail of the firm's interactive cloud computing platform Audens AID (Aid on Implementing Data), which allows them to keep personal data processing up to date and access data protection clauses and agreements.

Practice head(s):

Marcos Judel; Leandro Núñez

Other key lawyers:

Héctor Oliver Almeida; Jon Vicuña Sanabria

Key clients

CGPJ (General Council of the Spanish judicial authority”)

Consejo General de Cámaras de Comercio de España (General Council of the Spanish Chambers of Commerce)

Avanza Spain

Avanza Zaragoza

Roi up

Workout events


Samplia Media

Gato Salvaje



Work highlights

  • Provided legal advice in order to align the General Council of the Spanish Chambers of Commerce’s processes with the General Data Protection Regulation.
  • Performs the role of external Data Protection Officer (DPO) for Avanza Spain, the parent company of the Avanza transport group, which, in turn, forms part of the international group Mobility Ado.
  • Advises on the adaptation of Roi Up Agency’s processes to GDPR, as well as the processes of the group’s companies (Roi Up Media, Artelier Comunicación y Eventos), and on cross-border data flow between subsidiaries in several countries.


Leading Iberian firm Cuatrecasas complements its IP and TMT offering with significant data privacy expertise. Barcelona-based IP expert Albert Agustinoy leads on data protection matters, and has particular knowledge of the IT, e-commerce and gaming industries. Counsel Alejandro Negro is a name to note in Madrid. In light of the substantial growth of technology and innovation in the legal services sector, the firm has been developing a number of initiatives, including the establishment of a digital economy focus group within its European network.

Practice head(s):

Albert Agustinoy

Other key lawyers:

Alejandro Negro; Jorge Monclús

Key clients











Work highlights

  • Provides ongoing advice on data protection issues, including on privacy issues connected with an app for facial recognition, and the use of drones for moving spare parts.
  • Provides advice on data protection issues, including on the impact of GDPR on business.
  • Advising on managing and developing its e-commerce platform and social networks, including all aspects regarding privacy and data protection in relation to sending advertising material.

Gómez-Acebo & Pombo

Sitting within the IP and IT department, the data protection group at Gómez-Acebo & Pombo provides wide-ranging advice to clients on privacy and e-commerce, and stands out in particular for its expertise in international data transfers. IP and unfair competition specialist Eduardo Castillo leads the team, with strong input from key associates Isabela Crespo and Bárbara Sainz de Vicuña.

Practice head(s):

Eduardo Castillo

Other key lawyers:

Isabela Crespo; Bárbara Sainz de Vicuña


‘It is a very good team, quick to respond and with a focus on the client and its sector.’

‘The team has a very good knowledge of the area and of the news and thanks to this capacity their responses can go beyond what is expected.’

Key clients





Work highlights

  • Advised Carrefour in relation to data protection and e-commerce issues.
  • Provides advice on several corporate, contractual, regulatory, public procurement, data protection and IP matters to Bayer Hispania.
  • Advises Pandora España on several corporate, contractual, digital and data protection matters.

Roca Junyent

Roca Junyent's data protection team is 'adapted to the new digital reality of business' and is noted for its 'broad vision of the market and special attention to detail'. Teresa Pereyra leads the team and draws on previous experience at the Madrid data protection authority (APDCM); she and the team advise major Spanish clients on data protection compliance, data transfers and security breaches.

Practice head(s):

Teresa Pereyra

Other key lawyers:

Laura Caballero; José Manuel Miralles; Blanca Cortés; Carlos Blanco Morillo


‘Roca Junyent’s team is defined by a high legal knowledge and a perfect interpretation of the company’s needs, the latter being a very favorable point compared to other firms. Very qualified team with excellent communication and reading skills.’

‘Teresa Pereyra Caramé demonstrates a total knowledge on the subject, an excellent ability to understand the flows of her clients’ companies, as well as a communication capacity in an extraordinary way and time.’

‘Teresa Pereyra, head of Roca Junyent’s data protection team, is a very responsible person, studious of the subject, and driving force, always trying to solve the questions raised in a precise and detailed way.’

‘The Roca Junyent team is exceptional. I have been counting on them (as a client) for years to attend to our legal matters. All the team attorneys we have worked with have performed their work diligently, meeting the established deadlines, and presenting more than satisfactory results. They develop a job of high professional quality. I have worked with many firms to date, and without a doubt the one with which I have had the best experience is with Roca Junyent.’

‘Teresa Pereyra Caramé – Head of Data Protection and Information Technology: In all cases, she has shown herself dedicated to each project, has perfectly understood the needs of each client, and has been able to offer satisfactory solutions for each problem. All this, meeting each deadline and working with agility. She is a tireless attorney with excellent client relationships. Carlos Blanco Morillo – Partner: Carlos is a high level professional, with great communication skills, being able to adapt a difficult message to interlocutors who are not used to legal language. He knows how to perfectly synthesize all inquiries, and offers quick solutions adapted to each situation.’

‘The Roca Junyent team is a competitive team, highly trained and that performs its functions in a brilliant way. At the level of privacy and data protection, they are always up to date with any new legislation, any changes and have a great disposition.’

‘Lawyers are totally at the service of their clients, having them as a priority and they always do everything possible to provide a quality service. I would highlight Teresa Pereyra, for her great involvement in the projects, her training and her great empathy.’

‘Blanca Cortés. Always available, accessible, conciliatory, transparent and empathetic. Teresa Pereyra always available, professional, serious and transparent.’

Key clients



Work highlights

  • Provided legal advice to the client in relation to the data protection aspects regarding the company sale to the competitor Vinted.
  • Advised Viva Credit in relation to the data protection policies relating to the setting-up of consumer credit operation in Spain under the brand Movinero.