Our practices, focused on compliance.

Strategy, GDPR and compliance. One firm for the three fronts.

Data Protection & GDPR

21 services

Accessibility Law (EAA)

We adapt your e-commerce, banking, transport or communications to Law 11/2023 (European Accessibility Act) and reduce the risk of penalties.

View details Cyber Resilience Act (CRA)

Scoping, essential cybersecurity requirements and vulnerability lifecycle management for products with digital elements.

View details Outsourced DPO in Burgos

Outsourced Data Protection Officer in Burgos: registration with the AEPD, breach response under 24h and yearly training. Direct contact.

View details Outsourced DPO in Palencia

Outsourced Data Protection Officer in Palencia: registration with the AEPD, breach response under 24h and yearly training.

View details Outsourced DPO in León

Outsourced Data Protection Officer in León: registration with the AEPD, breach response under 24h and periodic visits to the capital.

View details Outsourced DPO in Salamanca

Outsourced Data Protection Officer in Salamanca: registration with the AEPD, breach response under 24h and yearly training for law firms.

View details Outsourced DPO in Las Palmas

Outsourced Data Protection Officer in Las Palmas de Gran Canaria: registration with the AEPD.

View details Outsourced DPO in Tenerife

Outsourced Data Protection Officer in Tenerife: registration with the AEPD, breach response under 24h and yearly training for hotels.

View details DPO for public administrations

Data Protection Officer for town councils, joint boards and public bodies: mandatory with no exception under GDPR art. 37.1.a.

View details External DPO in Valladolid

External Data Protection Officer in Valladolid: AEPD registration, breach channel within 24h and in-person support from our office at Fray Luis de León 3.

View details GDPR and LOPDGDD consulting

GDPR and LOPDGDD adequacy for SMEs: records of processing, processor agreements, breaches and training. Real compliance, not templates.

View details Outsourced DPO

We take on the external DPO role with our own verticals in healthcare, education, religious sector, associations and local government. Breach response in under 24 hours, a real channel (not a generic email) and annual training.

View details Data subject rights

Operational procedure for handling ARCO rights requests: official channel, requester verification, a reasoned response within one month and documentary records under Article 12 GDPR.

View details Data breaches

Response protocol for GDPR security breaches: notification to the AEPD within 72 hours, communication to those affected and documentary records without delay or omissions.

View details CCTV & GDPR

We bring your CCTV system into line with GDPR and LOPDGDD: information notices, retention periods, workplace cameras and a breach protocol.

View details GDPR for advisory firms and law offices

GDPR adequacy for advisory firms, tax and legal practices: processor agreements, dual-track records of processing and security measures for those handling third-party data daily.

View details GDPR for homeowner associations

GDPR adequacy for homeowner associations: CCTV in common areas, publication of defaulters under the LOPDGDD and a processor agreement with the property manager.

View details Education GDPR

We protect your students' and families' data so you can innovate in the classroom without legal risk.

View details GDPR for gyms and fitness centers

Comprehensive GDPR adequacy for gyms and fitness centres: access biometrics, mandatory DPIA, a non-biometric alternative, health data and CCTV, with support from Summum Consultoría.

View details GDPR for hospitality

GDPR adequacy for hospitality businesses: bookings, guest registration, CCTV and loyalty programmes for restaurants, hotels and tourist accommodation.

View details GDPR for real estate agencies

GDPR adequacy for real estate agencies: engagement letters, CRM, data transfers between parties and commercial communications compliant with the LSSI, with expert support across Castilla y León and the Canary Islands.

View details Healthcare GDPR

Tailored GDPR compliance for clinics and healthcare centres: documentation, protocols and an external DPO without disrupting patient care.

View details

GDPR Near You (Local Offices)

7 services

Data protection in Burgos

Data protection support for companies and SMEs in Burgos and Castilla y León: GDPR adequacy, outsourced DPO and incident management with local presence and ongoing support.

View details Data protection in Las Palmas

GDPR consulting in Las Palmas de Gran Canaria: support with regulatory adequacy, outsourced DPO and data protection for Canary Island companies, with remote support and occasional on-site visits.

View details Data protection in Leon

Data protection consulting in León: we support SMEs and freelancers in León with GDPR and LOPDGDD adequacy, with periodic in-person support and permanent remote support.

View details Data protection in Palencia

Data protection consulting in Palencia: GDPR adequacy, outsourced DPO and support for the Palencia business community, with in-person and remote support.

View details Data protection in Salamanca

Data protection support for SMEs, practices and clinics in Salamanca: GDPR and LOPDGDD adequacy with in-person and remote support from Castilla y León.

View details Data protection in Tenerife

Expert data protection support for companies and institutions in Tenerife: GDPR adequacy, outsourced DPO and ongoing privacy management from the Canary Islands.

View details Data protection in Valladolid

Data protection consulting in Valladolid: GDPR adequacy, outsourced DPO and in-person or remote support for SMEs and organisations in Castilla y León.

View details

Regulatory Compliance & Cybersecurity

5 services

EU AI Act compliance

The AI Act applies generally from 2 August 2026 (Annex III high-risk obligations deferred to December 2027 by Regulation (EU) 2026/1744). We take you to compliance without waiting for a penalty. Consultoría + IA + Calidad cluster.

View details NIS2 · DORA

We coordinate the regulatory and procedural side of NIS2 and DORA; we work directly with Summum Sistemas on the technical side.

View details ENS (Spanish public-sector security)

Alignment with updated RD 311/2022 across its three categories (Basic, Medium, High). Can be combined with ENS for AI systems.

View details Criminal compliance · UNE 19601

Criminal risk map, code of ethics, whistleblowing channel compliant with Spanish Law 2/2023 and an operational compliance committee.

View details External compliance consultant

The article 31 bis organisation and management model kept alive month by month: criminal risk map, Law 2/2023 channel and documented periodic verification.

View details Whistleblowing channel

Whistleblowing channel compliant with Ley 2/2023: full implementation, no unnecessary red tape, ready for the AIPI.

View details AML compliance

We implement your AML/CFT system so that SEPBLAC finds order, not gaps.

View details

Strategy & Corporate Governance

4 services

Strategy & transformation

3-year vision, explicit business model, growth levers. Regulation is embedded in the plan, not appended at the end.

View details Corporate governance

Give your company real structure: an operational board, board secretariat and bylaws that open doors to investors and major clients.

View details Data governance

Once GDPR compliance matures, governance follows: a data owner per asset, measured data quality, a retention policy and a single catalogue.

View details Interim management

Interim management for SMEs in transition: an experienced executive leading finance, operations or transformation, for exactly the time needed.

View details M&A advisory for SMEs

M&A advisory for SME buy-outs and sell-outs: valuation, due diligence and support through negotiation to closing.

View details

Specialized Legal & Regulatory Advisory

6 services

Public tenders

We identify the contract, prepare the bid and take you through to award.

View details Transparency law

Publish what the law requires, protect what the RGPD restricts, and turn transparency into a competitive advantage with public authorities.

View details E-commerce legal compliance

Bring your online store's legal notices up to standard and sell without the risk of penalties.

View details CE marking

Bring your product to the European market with the documentary and regulatory support required by CE marking.

View details Trademarks & patents

Protect your brand, design and invention before a competitor does: we handle registration with the OEPM, EUIPO and WIPO from start to finish.

View details R&D grants

We unlock the R&D tax deductions and grants your company is already generating without knowing it.

View details

Labor & Employment Compliance

2 services

Equality plans

Your equality plan negotiated, audited and registered: turning a legal obligation into a competitive advantage for talent acquisition.

View details Working time log

Digital working-time records that pass any inspection — no paper, no spreadsheets, no risk.

View details

Sustainability & ESG

1 service

ESG & CSRD reporting

Turn sustainability reporting obligations into a real competitive advantage with clients, investors and regulators.

View details

Before the plan,
the diagnosis.

Talk to an expert→ View cases→

Our practices, focused on compliance.

We adapt your e-commerce, banking, transport or communications to Law 11/2023 (European Accessibility Act) and reduce the risk of penalties.

Scoping, essential cybersecurity requirements and vulnerability lifecycle management for products with digital elements.

Outsourced Data Protection Officer in Burgos: registration with the AEPD, breach response under 24h and yearly training. Direct contact.

Outsourced Data Protection Officer in Palencia: registration with the AEPD, breach response under 24h and yearly training.

Outsourced Data Protection Officer in León: registration with the AEPD, breach response under 24h and periodic visits to the capital.

Outsourced Data Protection Officer in Salamanca: registration with the AEPD, breach response under 24h and yearly training for law firms.

Outsourced Data Protection Officer in Las Palmas de Gran Canaria: registration with the AEPD.

Outsourced Data Protection Officer in Tenerife: registration with the AEPD, breach response under 24h and yearly training for hotels.

Data Protection Officer for town councils, joint boards and public bodies: mandatory with no exception under GDPR art. 37.1.a.

External Data Protection Officer in Valladolid: AEPD registration, breach channel within 24h and in-person support from our office at Fray Luis de León 3.

GDPR and LOPDGDD adequacy for SMEs: records of processing, processor agreements, breaches and training. Real compliance, not templates.

We take on the external DPO role with our own verticals in healthcare, education, religious sector, associations and local government. Breach response in under 24 hours, a real channel (not a generic email) and annual training.

Operational procedure for handling ARCO rights requests: official channel, requester verification, a reasoned response within one month and documentary records under Article 12 GDPR.

Response protocol for GDPR security breaches: notification to the AEPD within 72 hours, communication to those affected and documentary records without delay or omissions.

We bring your CCTV system into line with GDPR and LOPDGDD: information notices, retention periods, workplace cameras and a breach protocol.

GDPR adequacy for advisory firms, tax and legal practices: processor agreements, dual-track records of processing and security measures for those handling third-party data daily.

GDPR adequacy for homeowner associations: CCTV in common areas, publication of defaulters under the LOPDGDD and a processor agreement with the property manager.

We protect your students' and families' data so you can innovate in the classroom without legal risk.

Comprehensive GDPR adequacy for gyms and fitness centres: access biometrics, mandatory DPIA, a non-biometric alternative, health data and CCTV, with support from Summum Consultoría.

GDPR adequacy for hospitality businesses: bookings, guest registration, CCTV and loyalty programmes for restaurants, hotels and tourist accommodation.

GDPR adequacy for real estate agencies: engagement letters, CRM, data transfers between parties and commercial communications compliant with the LSSI, with expert support across Castilla y León and the Canary Islands.

Tailored GDPR compliance for clinics and healthcare centres: documentation, protocols and an external DPO without disrupting patient care.

Data protection support for companies and SMEs in Burgos and Castilla y León: GDPR adequacy, outsourced DPO and incident management with local presence and ongoing support.

GDPR consulting in Las Palmas de Gran Canaria: support with regulatory adequacy, outsourced DPO and data protection for Canary Island companies, with remote support and occasional on-site visits.

Data protection consulting in León: we support SMEs and freelancers in León with GDPR and LOPDGDD adequacy, with periodic in-person support and permanent remote support.

Data protection consulting in Palencia: GDPR adequacy, outsourced DPO and support for the Palencia business community, with in-person and remote support.

Data protection support for SMEs, practices and clinics in Salamanca: GDPR and LOPDGDD adequacy with in-person and remote support from Castilla y León.

Expert data protection support for companies and institutions in Tenerife: GDPR adequacy, outsourced DPO and ongoing privacy management from the Canary Islands.

Data protection consulting in Valladolid: GDPR adequacy, outsourced DPO and in-person or remote support for SMEs and organisations in Castilla y León.

The AI Act applies generally from 2 August 2026 (Annex III high-risk obligations deferred to December 2027 by Regulation (EU) 2026/1744). We take you to compliance without waiting for a penalty. Consultoría + IA + Calidad cluster.

We coordinate the regulatory and procedural side of NIS2 and DORA; we work directly with Summum Sistemas on the technical side.

Alignment with updated RD 311/2022 across its three categories (Basic, Medium, High). Can be combined with ENS for AI systems.

Criminal risk map, code of ethics, whistleblowing channel compliant with Spanish Law 2/2023 and an operational compliance committee.

The article 31 bis organisation and management model kept alive month by month: criminal risk map, Law 2/2023 channel and documented periodic verification.

Whistleblowing channel compliant with Ley 2/2023: full implementation, no unnecessary red tape, ready for the AIPI.

We implement your AML/CFT system so that SEPBLAC finds order, not gaps.

3-year vision, explicit business model, growth levers. Regulation is embedded in the plan, not appended at the end.

Give your company real structure: an operational board, board secretariat and bylaws that open doors to investors and major clients.

Once GDPR compliance matures, governance follows: a data owner per asset, measured data quality, a retention policy and a single catalogue.

Interim management for SMEs in transition: an experienced executive leading finance, operations or transformation, for exactly the time needed.

M&A advisory for SME buy-outs and sell-outs: valuation, due diligence and support through negotiation to closing.

We identify the contract, prepare the bid and take you through to award.

Publish what the law requires, protect what the RGPD restricts, and turn transparency into a competitive advantage with public authorities.

Bring your online store's legal notices up to standard and sell without the risk of penalties.

Bring your product to the European market with the documentary and regulatory support required by CE marking.

Protect your brand, design and invention before a competitor does: we handle registration with the OEPM, EUIPO and WIPO from start to finish.

We unlock the R&D tax deductions and grants your company is already generating without knowing it.

Your equality plan negotiated, audited and registered: turning a legal obligation into a competitive advantage for talent acquisition.

Digital working-time records that pass any inspection — no paper, no spreadsheets, no risk.

Turn sustainability reporting obligations into a real competitive advantage with clients, investors and regulators.

Before the plan,the diagnosis.

Before the plan,
the diagnosis.