Lawyers specialising in data protection in Spain
Data protection legislation governs how data that identifies or could identify an individual must be processed, setting out obligations for companies, professionals and organisations that use such data in the course of their business. This legal framework requires that the legal basis for each processing operation be determined, that appropriate technical and organisational measures be implemented, and that the rights of data subjects be safeguarded.
Businesses in any sector, public authorities, self-employed professionals and non-profit organisations must comply with specific technical and organisational requirements in order to avoid administrative penalties, claims from data subjects or reputational damage arising from security incidents or unlawful processing.
BGI LAW advises companies and organisations on the design and implementation of regulatory compliance systems relating to data privacy, drafts documentation tailored to each specific activity, represents clients before the Spanish Data Protection Agency and other European authorities, and defends them against complaints or disciplinary proceedings. Every case is based on a detailed analysis of data processing, a risk assessment and the rigorous application of the most recent case law of the Court of Justice of the European Union.
The firm’s experience in data protection
From our offices in Marbella, Madrid and Vigo, we offer data protection compliance services to organisations in sectors such as healthcare, technology, e-commerce, hospitality, education, banking and insurance. With extensive experience advising on compliance with the GDPR since it came into force, we have developed specialist knowledge in the areas of data protection impact assessments, international data transfers, video surveillance, digital marketing and data breach management.
Our partnership with BGI Global enables us to coordinate strategies when data processing involves data controllers or data processors located in different jurisdictions. We operate by combining technical training in data protection, expertise in dealing with supervisory authorities, and the ability to translate legal obligations into workable operational protocols.
Areas of specialism for data protection lawyers
Regulatory compliance
Data Protection Officer (DPO)
Exercising ARCO rights
(Right of access, rectification, erasure and objection)
Specific areas of data protection
Risk management and procedures
ante autoridades
Data Protection Impact Assessments (DPIAs)
- Risk analysis in high-risk treatments.
- Technical and organisational mitigation measures.
- Supporting documentation for audits.
Security vulnerabilities
-
Detection and response protocols.
-
Notification to the supervisory authority.
-
Notification to those affected, where appropriate.
International transfers
- Standard contract terms.
- Binding corporate rules.
- Compliance following Schrems II.
Regulatory oversight
and relations with third parties
Hidden
Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.
Disciplinary proceedings before the AEPD
- Defence in disciplinary proceedings.
- Administrative complaints and appeals.
- Negotiation of remedial measures.
Contracts with data processors
- Drafting and reviewing contracts with data processors.
- Audit of suppliers and subcontractors.
- Confidentiality agreements and specific contractual clauses.
Audit of suppliers and external services
- Third-party compliance assessment.
- Supplier risk analysis.
- Verification of data protection safeguards.
Sectors and
specific applications
Hidden
Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.
CCTV
- System design in accordance with regulations.
- Signage and information layers.
- Retention of images and handover to the police.
Marketing and profiling
- Legal basis for sending marketing communications.
- Cookies and tracking technologies.
- Automated decision-making and profiling.
Human Resources and employee data
- Data processing in payroll and HR
- Management of sensitive data in the workplace.
- Internal procedures and record-keeping
Work methodology
1. Initial assessment
Identification of the processing operations carried out, the purposes pursued and the legal bases applied.
2. Gap analysis
Identification of non-compliance with GDPR obligations and assessment of the level of risk exposure.
3. Action plan
Implementation of corrective measures, drafting of mandatory documentation and staff training.
4. Continuous monitoring
Regular review of regulatory changes, updating of records and assistance with incidents or complaints.
Frequently Asked Questions (FAQs) on data protection regulations
Hidden
Do all organisations have to appoint a Data Protection Officer?
The appointment is mandatory only in the cases specified by the regulations, such as public bodies, organisations that process sensitive data on a large scale, or activities involving the regular and systematic monitoring of individuals. In all other cases, the matter is assessed on a case-by-case basis.
What is the deadline for reporting a data breach?
The supervisory authority must be notified within a maximum of 72 hours of becoming aware of the incident, unless it is unlikely to affect individuals’ rights. In some cases, it is also necessary to notify the data subjects.
Is it enough just to have a privacy policy on the website?
No. The privacy policy is only one aspect of compliance. In addition to providing adequate information, you must demonstrate a lawful basis for each processing operation, facilitate the exercise of data subjects’ rights, implement security measures and comply with the principle of proactive accountability.
What is the Record of Processing Activities, and who is responsible for compiling it?
All organisations that process personal data must keep an up-to-date record describing each processing operation: purpose, legal basis, categories of data, recipients and security measures. This is a mandatory document and is essential for any audit.
When is a Data Protection Impact Assessment (DPIA) required?
It is mandatory when a processing operation may pose a high risk to individuals’ rights, such as mass surveillance, the use of sensitive data or innovative technologies. It helps to identify risks and define mitigation measures.
What are my obligations if I outsource services that involve access to data?
A contract must be drawn up with the data processor, setting out obligations regarding confidentiality, security, restrictions on use and subcontracting. The company remains responsible for ensuring compliance.
How should requests for access to, rectification or erasure of data be handled?
Applications must be dealt with without undue delay and, in any event, within a maximum of one month. It is essential to verify the applicant’s identity and to document the entire process.
What happens if I don’t comply with data protection regulations?
In addition to financial penalties, measures may be imposed to restrict or suspend processing, and data subjects may lodge complaints, whilst reputational damage may also occur. Proactive accountability requires demonstrating compliance at all times.
What documentation must a company have in order to comply with the GDPR?
A company must maintain a record of data processing activities, a risk assessment, contracts with suppliers who access data, and internal security policies. This documentation demonstrates compliance and must be kept up to date.
What should you do if the AEPD launches an investigation or issues a request for information?
It is essential to respond within the specified timeframes and to provide all documentation demonstrating compliance: internal policies, records, contracts with suppliers and evidence of the measures implemented. It is also advisable to analyse the scope of the request, prepare a response strategy and review potential risks before submitting the information. BGI Law can assist throughout the process, from preparing the documentation to providing legal defence should disciplinary proceedings be initiated.
Contact form
The processing of personal data entails legal responsibilities that require constant attention and adaptation to ever-changing regulations. If you require specialist advice on data protection or assistance in dealings with the AEPD, our team can assess your case and propose the appropriate strategy.
If you prefer, you can call us by selecting this option.
If you prefer, you can send us an email by selecting this option.