Data privacy and data protection in Spain

Baker McKenzie

Baker McKenzie advises on data use, evaluating risk, compliance and preventative measures. The firm has significant experience in cybersecurity and data breach matters, as well as assisting tech companies with data issues related to the launching of new projects. In addition, the practice is known for its expertise in the developing areas of AI, machine learning and digital banking. Raúl Rubio leads the team and focuses on technology, telecoms, advertising, media and privacy. He also specialises in electronic signature and information security matters.

Practice head(s):

Raúl Rubio


The ‘thorough and pragmaticECIJA has a deep bench of lawyers and technicians with ‘expertise and specialisation’ in privacy and data protection. The firm has experience in a range of cybersecurity matters, including litigation, as well as providing a consultancy to assist companies with adapting to new regulations. Notable in the team are Alejandro Touriño, who advises nationally and internationally on issues related to IP, new technologies, privacy and entrepreneurship law, and Daniel López, who is known for data protection, compliance, information security and technology law.


‘They have a very practical approach, and they use simple and plain language to address complex matters’

‘They have a lot of energy, and you can feel that they are passionate about what they do’

‘The best experts in the field and with very competitive rates’

‘Their performance is very good. The responses to our questions are immediate and very valuable’

‘High level of specialisation’

‘Salvador Silvestre has a very strong knowledge of privacy and IP regulations, and provides a full-service approach at the time of assessing a problem or situation. He is very responsive and practical’

‘Cristina Martinez Garay has a massive knowledge of data protection, and her advice is always straightforward but comprehensive. You always feel that you are in very good hands’

‘Daniel López is always willing to find imaginative solutions to any legal problem. It is nice to work with him and he is a great expert in the health sector’

‘Carlos Pérez is a person with a great capacity to offer solutions and adapt them to the needs of his clients. In addition, he is involved in the reality of the company for which he works, knowing its processes and ways of working, which greatly facilitates the work to be done’

Key clients

World Bank

Bank of Spain







NH Hotels


Teva Pharma

Roche Pharma



BNP Paribas

Colt Telecom

Work highlights

  • Advised the Bank of Spain on the process of adaptation to the GDPR.
  • Advising Banco Santander on all matters regarding privacy and data protection and acting as data protection officer (DPO) for certain divisions of the company.
  • Advised Alphabet, the renting division of BMW, on the process of adaptation to the GDPR and acts as DPO of the company.

Hogan Lovells International LLP

The ‘smart, capable and proactiveHogan Lovells International LLP is experienced in GDPR work, particularly post-implementation issues. The 'closely-knit team with great attitude and in-depth knowledge’ is also active in cybersecurity advice, including data breaches and related litigation. Gonzalo F Gállego  leads the practice and is known as ‘one of the best existing data privacy lawyers, with deep knowledge, a broad approach and sharp thinking, as well as being a really nice person’. Also notable in the team is associate Laur Badín, who focuses on privacy, cybersecurity, data protection, e-privacy, commercial IP and IT law related matters.

Practice head(s):

Gonzalo F. Gállego


‘The team is expert in the subject but its strengths come from its constructive and pragmatic approach, ability to interact with a variety of individuals, responsiveness and client service orientation’

‘They differ from other firms in that they put in much more effort to get to know their client’s business’

‘Top performer, high-quality services provided, professional English level, availability out of working hours’

‘Hogan Lovells’ privacy team provides really good and reliable advice, which is more clear and accurate than other law firms, irrespective of the firm size’

‘Gonzalo F. Gállego has deep knowledge and full availability. He maintains a close relationship with the client and provides specific and detailed responses’

‘Santiago de Ampuero has strong knowledge and problem-solving abilities, and an optimistic attitude’

‘Gonzalo F. Gállego is an outstanding player: accessible, service oriented and an excellent leader for his team. His passion for his job is unique’

‘Laur Badín is a key member of the team and an extremely valuable point of contact’

‘They are extra attentive, and have a good sixth sense for privacy issues that you do not find everywhere’

‘Víctor Mella is very dedicated, knowledgeable and a pleasure to work with’

‘Clara Lázaro is extremely perceptive and responsive, and has a great view of the big picture for privacy requirements internationally’

Key clients



Work highlights

  • Advising the Applus+ group in Spain and other countries on GDPR compliance and local data protection requirements.


Garrigues provides ‘comprehensive in-depth knowledge of privacy and IT matters'. The firm has experience in advising companies on adapting to the GDPR, as well as post-implementation audits. The broad practice covers e-commerce, security measures, cyber-attacks and advice in relation to big data analytics. Alejandro Padín leads the group and has expertise in technology issues arising from the commercial and corporate, privacy and litigation areas. His team includes senior associate Katiana Otero, who is known for IT, electronic commerce, privacy and data protection.

Practice head(s):

Alejandro Padín


‘You can rely on them providing up-to-date accurate advice, since they are involved in the most innovative projects in Spain’

‘Senior associate Katiana Otero is very flexible, client-oriented and a pleasure to work with. Business teams appreciate her approach and understanding of business needs, providing practical legal advice that is transferable to products and services’

‘An excellent team performance’

‘Effective communication with the client’

‘Appropriate understanding of the requirements of projects and problems involving data privacy’

‘Very high level of knowledge in data privacy and data protection law’

‘Excellent understanding of the problems’

Key clients

Alsea Group

Antolín Group

APD (Association for the Development of Management











Deutsche Bank

DIA Alimentación

Estée Lauder



Work highlights

  • Advised Grupo Vocento on adapting to the GDPR.
  • Advised Telefónica on the adaptation of several of its businesses to the GDPR.

Ramón y Cajal Abogados

The ‘extremely goodRamón y Cajal Abogados focuses on IT trends, complex IT agreements, e-commerce and fintech. The ‘great team is very responsive, with excellent business acumen’, particularly in the automotive, gaming, technology and financial sectors. Norman Heckh leads the practice and provides ‘thoughtful and pragmatic advice which is both strong from a legal perspective but also actionable.’ Also notable in the area is senior associate María Luisa González, who has experience advising multinational companies and public administration bodies on matters relating to privacy and data protection law, information security, IP, social networks and e-commerce.

Practice head(s):

Norman Heckh


‘Their competence and the efficiency of their response’

‘The privacy team of Ramon y Cajal Abogados is one the best in Spain’

‘Responsive, efficient, good English language capabilities’

‘Norman Heckh has great experience in the field and industry, being in my view a top-notch tech lawyer. All that grants him assertiveness, reliability, seriousness and a business-minded approach in his advice and support. Furthermore, he knows how to deal with complex negotiations’

‘María Luisa González is an incredible privacy lawyer’

‘Norman Heckh and María Luisa González are nowadays two of the best data protection lawyers in Spain, being able to understand the challenges new technologies bring to privacy’   

‘Norman Heckh provides complete and excellent advice on all data protection issues, giving specific solution for particular situations’

‘Norman Heckh is a veteran among the Spanish data privacy professionals and has many years of experience’

Key clients



Vueling (IAG Group)

Iberia Express (IAG Group)

Level (IAG Group)

Aeléc (Spanish Electric Energy Association)

Gesternova Energía

Redexis Gas

General Optica


SoYou (Joint venture Bankia-Crédit Agricole)

Casa América

Sek Schools

El Economista

Haya Real Estate

Network Steel Resources

Work highlights

  • Advised Vueling on an extensive review of data protection and privacy matters.
  • Advised SoYou (a joint venture between Bankia and Crédit Agricole) on complex data and privacy matters.
  • Drafting a code of conduct under the GDPR for Aeléc.

Uría Menéndez

Uría Menéndez has multi-disciplinary expertise, advising on litigation and privacy work, primarily for large, multinational tech companies. Privacy, cyberlaw and fintech expert Leticia López-Lapuente leads the practice and specialises in technology and data protection matters for clients in the finance, tech and industry sectors. Her team is advising Microsoft on data protection and privacy issues in Spain.

Practice head(s):

Leticia López-Lapuente

Key clients





Banco Santander





Morgan Stanley

Slaughter and May

Covington & Burling


Work highlights

  • Advising Facebook on key data protection and privacy matters, including sanctioning administrative proceedings initiated by the Agencia Española de Protección de Datos (Spanish Data Protection Authority).
  • Advised on all the IT and data protection aspects and contracts of the acquisition by Bankinter of EVO Bank.
  • Advised the Ferroglobe group worldwide on its GDPR implementation project.


Active in contentious and non-contentious matters, Cuatrecasas has experience advising on the new regulatory framework of the GDPR, as well as compliance and post-implementation issues. The firm is known for its sector expertise in digital economies, life sciences, the automotive industry and gaming. IP and new technologies expert Albert Agustinoy co-leads the practice with Álvaro Bourkaib, who specialises in data protection and asset transfers.

Key clients




Boston Group Consulting

Catalana Occidente

Cerba Internacional





Gómez-Acebo & Pombo

Specialising in multi-juristictional and litigation issues, Gómez-Acebo & Pombo has expertise in the protection of personal data and privacy, as well as the implementation of data protection protocols and policies. The firm is also experienced in cybersecurity matters and in advising clients on sanctioning procedures carried out by the Spanish data protection agency. Practice head Eduardo Castillo specialises in IP and life sciences.

Practice head(s):

Eduardo Castillo

Key clients

Carrefour España

Bayer Hispania, SLU


Work highlights

  • Advising Carrefour in relation to data protection and e-commerce issues.
  • Advising CBRE on a number of copyright and data protection-related issues, including licensing, transferring and securing copyright work and results from employees, providers and other work-for-hire cases.

Deloitte Legal

Deloitte Legal provides risk advisory and cybersecurity teams, as well as significant experience in data protection matters. The firm is active advising clients on GDPR compliance, as well as on a range of cybersecurity matters. Dulce Mª Miranda Naranjo leads the practice and focuses on data protection and privacy in the IT and telecoms sectors, as well as related IP and unfair competition matters.

Practice head(s):

Dulce Mª Miranda Naranjo

Key clients

Banco Santander

Mercedes Benz España

Iberia Líneas Areas

Viesgo Energía

Siemens Gamesa


Financiera El Corte Inglés

Parques Reunidos

Barceló Hoteles


AtresMedia Corporación

Barclays Bank





PSA Financial

Work highlights

  • Advising Banco Santander on the legal, technical and organisational measures required to adapt to the new requirements in data protection.
  • Advising Barceló Gestión Hotelera on the legal, technical and organisational measures required to adapt to the new requirements in data protection.
  • Assisting Siemens Gamesa with data protection issues.


The ‘understanding of the client's needs combined with fast and correct answers’ defines DWF-RCD’s ‘exceptional service'. The multi-disciplinary practice has expertise in audits, data transfer and e-commerce, as well as particular experience in GDPR implementation and audits. The team is co-led by associate Victor Altimira, who is known for IT law, particularly data protection and e-commerce; associate Irene López, who ‘always has a global vision of any issue that helps to focus advice towards the best result’; and pharma privacy expert Jesús Martrat, who focuses on assisting pharmaceutical industry clients in data protection and privacy matters.


‘The data privacy and data protection team at RCD is very professional’

‘They have a very good knowledge of data privacy and protection law and they excel in accompanying their clients through the process of implementation of the data protection standard’

‘The speed, management and coordination between the related parties are excellent’

‘They have advanced knowledge of the GDPR, and they know how to resolve matters with the minimum inconvenience for the company’

‘Irene Lopez is patient with clients and her assistants were very helpful. They kept clarifying all my doubts and assisted me throughout the whole process’

‘Nuria Galera is an associate with a high level of speciality in data protection and with a high level of detail in everything she does’

‘Victor Altamira is a professional with very good skills, who knows all the difficulties associated with the GDPR and is able to make the solutions easy’