‘What really sets it apart is its innovative approach‘, say clients of ECIJA , where the privacy and data protection group is part of a market-leading TMT practice. Managing partner Alejandro Touriño is a standout practitioner in matters of IP and new technologies, while up-and-coming partners Jesús Yáñez, Daniel López – who has ‘great knowledge of the subject‘ – and Teresa Pereyra are highly experienced in compliance matters and are key advisers on regulatory developments. Barcelona-based Vanesa Alarcón regularly advises domestic and international clients on data protection and privacy, IT services and e-commerce matters.

The data protection, privacy, cybersecurity and technology practice at Garrigues is ‘up-to-date and very efficient, rigorous and compliant‘. Clients praise practice head Alejandro Padín and senior associate Katiana Otero as ‘upright lawyers who look after the interests of their clients with great knowledge and empathy‘. The firm handles data economy matters, including data monetisation projects, as well as regulatory issues concerning data privacy and cybersecurity, either in preparation for cyberattacks or as an incident response team. Padín and senior associate Álvaro Blanco assist major multinationals with day-to-day data protection matters, including the drafting and negotiation of international data transfer agreements with service providers.

Hogan Lovells Spain has a prominent position in the market, recommended ‘not only for its knowledge of regulations in force and being developed by regulators, but also for its ability to adapt advice to the client’s practical needs‘. Furthermore, it is ‘well resourced to support blue-chip instructions‘, counting Google and Applied Therapeutics among its clients. The ‘exceptional‘ Gonzalo F. Gállego is backed by a team of skilled associates, among them commercial IP and IT specialist Juan Ramón Robles, who advises on the design of policies and procedures for e-commerce platforms, and senior associate Santiago De Ampuero Castellanos, who frequently assists local and international companies in dealings with the Spanish Data Protection Agency. Associate Clara Lázaro focuses on e-commerce and commercial advertising matters.

Baker McKenzie has a multidisciplinary team featuring IP and technology expertise, as well as showcasing ‘extensive experience and knowledge in the field of data protection‘. Acting for an impressive roster of domestic and international companies, the group handles regulatory matters, GDPR and privacy issues, content moderation, e-commerce, data protection, and contentious matters heard before the Spanish Data Protection Supervisory Authority. The practice is led by José María Méndez in Madrid and IP partner Cristina Duch in Barcelona, while associate Patricia Pérez is a key adviser on licensing and outsourcing agreements. ‘They get personally involved in the project, as if it were their own project‘, notes one client.

Bird & Bird‘s privacy and data protection practice has a strong position in cross-border matters, drawing on its extensive office network across Europe, Africa, the Middle East, Asia Pacific and North America. Clients praise the ‘flexible and business-oriented‘ practice for its ‘extensive experience in solving the most complex issues‘. Lead partner Joaquin Muñoz is a key adviser to international corporations on regulatory and compliance matters, working with major data platform companies on business-critical aspects of GDPR rules. Associate Paula Garralón stands out for her in-depth knowledge of cross-border personal data transfers and the management of data breaches.

CMS Albiñana y Suárez de Lezo‘s Madrid-based data protection practice is a key adviser to numerous Spanish blue-chip companies and international technology businesses on contentious instructions and regulatory matters, in addition to providing day-to-day advice on data issues. Practice head and global head of communications Javier Torre de Silva, who is best known for his expertise in telecoms regulation, works closely with associate Miguel Recio in key contentious matters. Counsel José Luis Piñar is well regarded by clients and peers alike for his ‘privileged understanding of the regulations and the initiatives of the different European supervisors, as well as the discussions and values ​​that led to their implementation‘. He is currently part of a working group drafting Spain’s Digital Rights Charter.

At Ramón y Cajal Abogados, ‘the advice and cooperation is very client-oriented, and in addition to profound professional knowledge, the team also offers creative solutions‘. The TMT and data protection group handles a vast range of work, covering cybersecurity, e-business, online gaming, IT contracts, outsourcing projects, compliance, and cloud computing issues. ‘Friendly and sympathetic‘ lead partner Norman Heckh ‘demonstrates a very high level of professional competence and detailed knowledge‘. Senior associate María Luisa González also plays a pivotal role in advising key clients of the firm.

Uría Menéndez has a stellar roster of clients, who turn to the firm for ‘the quality of the responses and understanding of the client’s needs‘ in data protection matters. Practice head Leticia López-Lapuente is highly regarded by peers and clients alike, garnering praise for her ‘practical knowledge and experience‘. She frequently assists a major multinational social media company with privacy and digital matters – including data protection, cookies and social networks – and offers representation in proceedings before the Spanish Data Protection Authority. Counsel Francisco Javier García also plays a key role in advising clients in the pharmaceutical, tobacco, e-commerce, IoT, software, cosmetics and fashion industries on privacy matters.

Andersen, which draws on a substantial network of lawyers across its offices in Madrid, Barcelona, Valencia and Seville, stands out for IT and digitalisation projects, for which it blends expertise in data privacy, digital business, regulatory, and IP law. Clients praise ‘its ability to find the best solution to the problems raised in an agile and effective way‘. Lead partner Isabel Martínez Moriel is experienced in data protection, privacy, IT and competition law. Associate María Zarzalejos, who focuses on commercial and regulatory matters, and corporate partner María Suárez, who handles data protection audits and due diligence projects, also play key roles in the practice.

Audens, which has offices in Madrid and Bilbao, is a boutique firm focused on – among other areas – privacy, data protection and technology law. The firm acts as data protection officer for numerous clients, and also handles data protection audits and the defence of contentious matters in disciplinary proceedings with the Spanish Data Protection Agency. The lead partners are Marcos Judel, who has ‘exceptional strategic and overall vision‘, and Leandro Núñez, who has ‘exceptional knowledge both at a theoretical and an implementation level‘. Senior associate Héctor Oliver Almeida, who handles data compliance and cyber law, is ‘able to convey incredibly complex issues in just a few words‘.

Cuatrecasas frequently acts as data protection officer for large corporate clients, among them Primavera Sound and Sony Music Entertainment. As well as assisting companies with day-to-day data protection advice, the firm is also helping clients adapt to the current regulations in Spain as they evolve. Counsel and practice head Alejandro Negro in Madrid stands out for regulatory advice on data protection and privacy compliance, data security breaches, investigations, and enforcement actions. Technology partner Albert Agustinoy, who is based in Barcelona, also handles data protection compliance matters as part of his broad practice. Partner Rafael Sánchez Aristi is also a key adviser on technology and digital media matters.

Praised as a firm which ‘perfectly combines technical knowledge and common sense in advice‘, Pérez-Llorca recently hired digital law expert Raúl Rubio from Deloitte Legal to lead the practice along with partner Andy Ramos Gil De La Haza. Rubio ‘stands out for his technical knowledge, practicality, creativity and ability to put himself in the shoes of an in-house lawyer‘. Associate Andrea Sánchez also plays a key role in the practice, particularly for her ability to analyse the compatibility of new technologies and algorithms with data protection regulations. Associate Antonio Muñoz-Torrero‘s experience in regulatory matters, litigation and technology procurement is a further boon to the practice.

Squire Patton Boggs is noted for the growing prominence of its dedicated data protection, cybersecurity and digital assets practice. The firm is praised for ‘the rigorous nature of its advice and the direct involvement of the partner‘, as well as its ‘deep understanding of technological projects‘. Lead partner Bartolome Martin, who joined from KPMG Abogados, Spain in 2022, is ‘the best privacy lawyer in Spain‘, according to one client. The work of Martin and associate Claire Murphy spans legal reports addressing data protection regulations, and dealings with the Spanish Data Protection Authority (AEPD) in the event of cyberattacks.

Clifford Chance handles a strong flow of litigation and advisory work arising from data privacy regulations, including significant matters before the Spanish Data Protection Agency (AEPD). The firm is a key adviser to Centros Comerciales Carrefour and its financial division on the data protection aspects of its day-to-day activity, with practice head and former State Attorney Fernando Irurzun taking the lead. All members of the practice have a dual adviser/litigator role which is a boon to the practice’s clients, among them Vodafone, which Irurzun assisted with proceedings before the AEPD concerning international data transfers and the processing of client data for marketing purposes.

Gómez-Acebo & Pombo has a ‘well-trained, very friendly team‘ whose work encompasses legal opinions on the protection of personal data, advice on the implementation of data protection protocols and policies, data protection audits, international data transfers, privacy and cookie policies, and broader cybersecurity matters. Senior associate Isabela Crespo leads the practice, with clients praising her ‘knowledge, sympathy and proactivity’. Crespo, who focuses on data protection and privacy, cybersecurity, and digital law, works closely with fellow senior associate Bárbara Sainz De Vicuña, who handles IT and IP matters.

PwC Tax & Legal Services has a wide-ranging data protection practice that handles data protection assessments, GDPR audits, privacy tool implementation, data governance matters and more. Fernando Fernandez-Miranda and his team of ‘excellent, proactive and hardworking lawyers‘ notably assisted General Electric with a strategic review of data protection matters arising from corporate spin-offs.