What are the most significant cases, projects and/or transactions that you and/or your legal team have recently been involved in?

One of the most significant projects I have recently participated in, leading the work together with the internal legal team, has been the comprehensive implementation of the personal data protection framework in the company, in accordance with the Organic Law on Personal Data Protection, its Regulations and the resolutions and guidelines issued by the supervisory authority.

As this is a relatively new subject in the country, the project required a comparative analysis of best practices and regional and European case studies to ensure a robust approach in line with international standards. Based on this, we carried out a survey and mapping of processes (data mapping), which allowed us to document the organisation’s activities in detail and identify the points of data processing (purposes, bases of legitimacy, data categories, recipients, transfers, retention periods and security measures).

As a result, we implemented a data protection management system that included the development and updating of policies and procedures for processing, addressing data subjects’ rights, incident/breach management, and governance and compliance guidelines. Finally, a training and awareness plan was implemented for employees, with the aim of ensuring operational adoption and alignment with applicable obligations as data controllers vis-à-vis data subjects and the supervisory authority.

How do you approach managing legal aspects during periods of instability or crisis to ensure the organisation’s resilience?

In periods of instability or crisis, legal management focuses on business continuity, risk control, and agile and timely decisions that are duly supported.

We analyse the situation in order to understand the causes and effects on our operation, the crisis committee meets to review the impact on both operations and confidential business information and personal data stored in our systems, employees, suppliers, sales force, facilities, and reputation. We review the regulations that we can leverage in our actions and establish a comprehensive action plan to ensure business continuity and operational security.