Team size: 11

What are the key projects that you have been involved in over the past twelve months?

Over the past twelve months, my key projects have centred on three main areas.

Firstly, data privacy regulatory implementation. I led the review and implementation of regulatory changes imposed by Peru’s new rules for its data protection framework (Ley N° 29733 and its regulations). This included updating internal policies, conducting gap analyses against new compliance requirements, designing data processing protocols, and coordinating cross-functional training to ensure organisation-wide adherence.

Secondly, litigation management and strategic recovery. I managed a multi-year billing dispute involving a utility provider, covering both extrajudicial negotiation — which resulted in a significant recovery — and the ongoing judicial phase, strategically framed as a negotiation lever to optimise the final settlement outcome.

Thirdly, regulatory analysis of infrastructure investment frameworks. I conducted in-depth legal analysis of new regulations governing public-private partnerships, specifically examining third-party investment mechanisms, contractual assignment structures, and the scope of regulatory oversight on economic-financial equilibrium — directly relevant to our asset-backed securitisation trusts and real estate investment operations.

How do you manage legal aspects during periods of instability or crisis, ensuring that your legal strategy aligns with the broader business?

In Peru, political and regulatory volatility is not an exception: it is the operating environment. At Real Plaza, we have learned that effective legal crisis management is fundamentally about coordinated teamwork across all areas of the company, with legal acting as a strategic connector, not as a gatekeeper.

When instability arises — whether from sudden regulatory changes, municipal conflicts, or social unrest affecting our business — our first response is cross-functional alignment. We coordinate immediately with operations, finance, commercial, and communications teams to ensure every decision accounts for both legal exposure and business continuity. The legal team’s role is to translate risk into actionable terms, not to slow down decision-making.

We never lose sight of the business during a crisis. A legal strategy that protects the company on paper but paralyses its operations is not a strategy: it is a liability. We identify the minimum viable compliance framework that allows the business to keep operating while we work toward the definitive legal solution. This requires trust built over time: when business leaders know that legal understands their priorities, they involve us earlier and follow our guidance more readily.

Are there any key trends that you think in-house lawyers should be monitoring over the next year?

The most transformative trend for in-house legal teams is the integration of artificial intelligence into compliance operations, particularly in data protection and privacy.

Latin America has regulatory frameworks maturing rapidly: Peru’s Personal Data Protection Law (Law No. 29733) has been in force for over a decade, Brazil’s LGPD continues to evolve, Colombia strengthens its Habeas Data regime, and Chile advances constitutional reform on data rights. Yet the implementation gap remains significant. Most companies still manage data protection obligations — consent management, ARCO rights, security measures, cross-border transfer documentation — through manual processes that cannot scale.

This is where AI becomes a strategic compliance enabler. AI-powered tools can automate the detection and classification of personal data, map processing flows in real time, generate breach alerts, and produce auditable compliance evidence. In sectors like retail, where millions of daily customer interactions generate vast volumes of personal data, this capability is an operational necessity.

Beyond data privacy, in-house lawyers should monitor how AI reshapes contract management, regulatory monitoring, and legal research. The lawyer who does not understand dynamic consent models or algorithmic auditing will not be in a position to advise effectively.

The convergence of data protection standards across the region also opens an opportunity: developing AI-driven compliance solutions trained on Latin American frameworks rather than depending solely on tools designed for the European GDPR. In-house counsel who leads this integration will redefine their role within their organisations.