Effective GDPR compliance for companies and organisations
Proper adaptation to the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD) requires far more than simply having privacy policies on a website. It involves reviewing how personal data is collected, used, stored, and protected within the organisation, as well as establishing internal procedures that ensure respect for individuals’ rights.
Within this framework, we support companies and institutions in comprehensive data protection compliance processes, providing ongoing legal advice that includes updates on regulatory developments and privacy-related legal obligations.
These services include, among others, the legal adaptation of websites and digital platforms, through the review or drafting of legal texts, layered information systems, and the updating of privacy policies and information notices. We also prepare the Record of Processing Activities and the information clauses required to comply with transparency obligations.
Our advisory services also cover the review of contracts with employees, clients, and suppliers involving the processing of personal data, as well as the drafting of data processing agreements, which are essential to regulate the relationship between controllers and service providers.
In addition, we conduct risk assessments and Data Protection Impact Assessments (DPIAs), particularly where processing activities may pose high risks to individuals’ rights and freedoms. We also advise on international data transfers, including mechanisms such as Binding Corporate Rules and other applicable legal safeguards.
Our team also assists in implementing internal compliance procedures, including the management of data subjects’ rights (access, rectification, erasure, and others), data breach notification procedures, handling of CVs in recruitment processes, and video surveillance protocols, including the drafting of relevant clauses and informational notices.
Finally, we provide legal assistance in claims or complaints related to data protection, whether brought by individuals, companies, or initiated by the Spanish Data Protection Authority (AEPD), supporting our clients throughout the entire process.
