Our practices, focused on compliance.

Strategy, GDPR and compliance. One firm for the three fronts.

Data Protection & GDPR

12 services

Outsourced DPO in Burgos

Delegado de Protección de Datos externo en Burgos: designación ante la AEPD, canal de brecha en 24h y un interlocutor fijo que conoce tu sector, no una centralita nacional.

View details Outsourced DPO in Palencia

Delegado de Protección de Datos externo en Palencia: designación ante la AEPD, canal de brecha en 24h y atención presencial periódica en la provincia.

View details Outsourced DPO in León

Delegado de Protección de Datos externo en León: designación ante la AEPD, canal de brecha en 24h y desplazamiento periódico a la capital, el Bierzo, La Bañeza y Sahagún.

View details Outsourced DPO in Salamanca

Delegado de Protección de Datos externo en Salamanca: designación ante la AEPD, canal de brecha en 24h y atención presencial y remota desde nuestra sede en Castilla y León.

View details Outsourced DPO in Las Palmas

Delegado de Protección de Datos externo en Las Palmas de Gran Canaria: designación ante la AEPD, canal de brecha en 24h y única presencia física del silo de protección de datos del grupo en Canarias.

View details Outsourced DPO in Tenerife

Delegado de Protección de Datos externo en Tenerife: designación ante la AEPD, canal de brecha en 24h y atención remota y presencial desde nuestra oficina en Las Palmas de Gran Canaria.

View details DPO for public administrations

DPO externo para ayuntamientos, mancomunidades y organismos públicos: designación obligatoria sin excepción por el artículo 37.1.a del RGPD, con la fórmula del delegado compartido cuando el municipio lo necesita.

View details External DPO in Valladolid

External Data Protection Officer in Valladolid: AEPD registration, breach channel within 24h and in-person support from our office at Fray Luis de León 3.

View details Consultoría RGPD y LOPDGDD

GDPR and LOPDGDD adequacy for SMEs: records of processing, processor agreements, breaches and training. Real compliance, not templates.

View details Outsourced DPO

We take on the external DPO role with our own verticals in healthcare, education, religious sector, associations and local government. Breach response in under 24 hours, a real channel (not a generic email) and annual training.

View details Data subject rights

Operational procedure for handling ARCO rights requests: official channel, requester verification, a reasoned response within one month and documentary records under Article 12 GDPR.

View details Data breaches

Response protocol for GDPR security breaches: notification to the AEPD within 72 hours, communication to those affected and documentary records without delay or omissions.

View details CCTV & GDPR

We bring your CCTV system into line with GDPR and LOPDGDD: information notices, retention periods, workplace cameras and a breach protocol.

View details GDPR for advisory firms and law offices

GDPR adequacy for advisory firms, tax and legal practices: processor agreements, dual-track records of processing and security measures for those handling third-party data daily.

View details GDPR for homeowner associations

GDPR adequacy for homeowner associations: CCTV in common areas, publication of defaulters under the LOPDGDD and a processor agreement with the property manager.

View details Education GDPR

We protect your students' and families' data so you can innovate in the classroom without legal risk.

View details GDPR for gyms and fitness centers

Comprehensive GDPR adequacy for gyms and fitness centres: access biometrics, mandatory DPIA, a non-biometric alternative, health data and CCTV, with support from Summum Consultoría.

View details GDPR for hospitality

GDPR adequacy for hospitality businesses: bookings, guest registration, CCTV and loyalty programmes for restaurants, hotels and tourist accommodation.

View details GDPR for real estate agencies

GDPR adequacy for real estate agencies: engagement letters, CRM, data transfers between parties and commercial communications compliant with the LSSI, with expert support across Castilla y León and the Canary Islands.

View details Healthcare GDPR

Tailored GDPR compliance for clinics and healthcare centres: documentation, protocols and an external DPO without disrupting patient care.

View details

GDPR Near You (Local Offices)

7 services

Data protection in Burgos

Data protection support for companies and SMEs in Burgos and Castilla y León: GDPR adequacy, outsourced DPO and incident management with local presence and ongoing support.

View details Data protection in Las Palmas

GDPR consulting in Las Palmas de Gran Canaria: support with regulatory adequacy, outsourced DPO and data protection for Canary Island companies, with remote support and occasional on-site visits.

View details Data protection in Leon

Data protection consulting in León: we support SMEs and freelancers in León with GDPR and LOPDGDD adequacy, with periodic in-person support and permanent remote support.

View details Data protection in Palencia

Data protection consulting in Palencia: GDPR adequacy, outsourced DPO and support for the Palencia business community, with in-person and remote support.

View details Data protection in Salamanca

Data protection support for SMEs, practices and clinics in Salamanca: GDPR and LOPDGDD adequacy with in-person and remote support from Castilla y León.

View details Data protection in Tenerife

Expert data protection support for companies and institutions in Tenerife: GDPR adequacy, outsourced DPO and ongoing privacy management from the Canary Islands.

View details Data protection in Valladolid

Data protection consulting in Valladolid: GDPR adequacy, outsourced DPO and in-person or remote support for SMEs and organisations in Castilla y León.

View details

Regulatory Compliance & Cybersecurity

6 services

EU AI Act compliance

The AI Act comes into full force on 2 August 2026 for high-risk systems. We take you to compliance without waiting for a penalty. Consultoría + IA + Calidad cluster.

View details NIS2 · DORA

We coordinate the regulatory and procedural side of NIS2 and DORA; we work directly with Summum Sistemas on the technical side.

View details ENS (Spanish public-sector security)

Alignment with updated RD 311/2022 across its three categories (Basic, Medium, High). Can be combined with ENS for AI systems.

View details Criminal compliance · UNE 19601

Criminal risk map, code of ethics, whistleblowing channel compliant with Law 2/2023 and an operational compliance committee.

View details Whistleblowing channel

Whistleblowing channel compliant with Ley 2/2023: full implementation, no unnecessary red tape, ready for the AIPI.

View details AML compliance

We implement your AML/CFT system so that SEPBLAC finds order, not gaps.

View details

Strategy & Corporate Governance

5 services

Strategy & transformation

3-year vision, explicit business model, growth levers. Regulation is embedded in the plan, not appended at the end.

View details Corporate governance

Give your company real structure: an operational board, board secretariat and bylaws that open doors to investors and major clients.

View details Data governance

Once GDPR compliance matures, governance follows: a data owner per asset, measured data quality, a retention policy and a single catalogue.

View details Dirección interina e interim management

Interim management for SMEs in transition: an experienced executive leading finance, operations or transformation, for exactly the time needed.

View details M&A advisory para pymes

M&A advisory for SME buy-outs and sell-outs: valuation, due diligence and support through negotiation to closing.

View details

Specialized Legal & Regulatory Advisory

6 services

Public tenders

We identify the contract, prepare the bid and take you through to award.

View details Transparency law

Publish what the law requires, protect what the RGPD restricts, and turn transparency into a competitive advantage with public authorities.

View details E-commerce legal compliance

Bring your online store's legal notices up to standard and sell without the risk of penalties.

View details CE marking

Bring your product to the European market with the documentary and regulatory support required by CE marking.

View details Trademarks & patents

Protect your brand, design and invention before a competitor does: we handle registration with the OEPM, EUIPO and WIPO from start to finish.

View details R&D grants

We unlock the R&D tax deductions and grants your company is already generating without knowing it.

View details

Labor & Employment Compliance

2 services

Equality plans

Your equality plan negotiated, audited and registered: turning a legal obligation into a competitive advantage for talent acquisition.

View details Working time log

Digital working-time records that pass any inspection — no paper, no spreadsheets, no risk.

View details

Sustainability & ESG

1 service

ESG & CSRD reporting

Turn sustainability reporting obligations into a real competitive advantage with clients, investors and regulators.

View details

Before the plan,
the diagnosis.

Talk to an expert→ View cases→

Our practices, focused on compliance.

Delegado de Protección de Datos externo en Burgos: designación ante la AEPD, canal de brecha en 24h y un interlocutor fijo que conoce tu sector, no una centralita nacional.

Delegado de Protección de Datos externo en Palencia: designación ante la AEPD, canal de brecha en 24h y atención presencial periódica en la provincia.

Delegado de Protección de Datos externo en León: designación ante la AEPD, canal de brecha en 24h y desplazamiento periódico a la capital, el Bierzo, La Bañeza y Sahagún.

Delegado de Protección de Datos externo en Salamanca: designación ante la AEPD, canal de brecha en 24h y atención presencial y remota desde nuestra sede en Castilla y León.

Delegado de Protección de Datos externo en Las Palmas de Gran Canaria: designación ante la AEPD, canal de brecha en 24h y única presencia física del silo de protección de datos del grupo en Canarias.

Delegado de Protección de Datos externo en Tenerife: designación ante la AEPD, canal de brecha en 24h y atención remota y presencial desde nuestra oficina en Las Palmas de Gran Canaria.

DPO externo para ayuntamientos, mancomunidades y organismos públicos: designación obligatoria sin excepción por el artículo 37.1.a del RGPD, con la fórmula del delegado compartido cuando el municipio lo necesita.

External Data Protection Officer in Valladolid: AEPD registration, breach channel within 24h and in-person support from our office at Fray Luis de León 3.

GDPR and LOPDGDD adequacy for SMEs: records of processing, processor agreements, breaches and training. Real compliance, not templates.

We take on the external DPO role with our own verticals in healthcare, education, religious sector, associations and local government. Breach response in under 24 hours, a real channel (not a generic email) and annual training.

Operational procedure for handling ARCO rights requests: official channel, requester verification, a reasoned response within one month and documentary records under Article 12 GDPR.

Response protocol for GDPR security breaches: notification to the AEPD within 72 hours, communication to those affected and documentary records without delay or omissions.

We bring your CCTV system into line with GDPR and LOPDGDD: information notices, retention periods, workplace cameras and a breach protocol.

GDPR adequacy for advisory firms, tax and legal practices: processor agreements, dual-track records of processing and security measures for those handling third-party data daily.

GDPR adequacy for homeowner associations: CCTV in common areas, publication of defaulters under the LOPDGDD and a processor agreement with the property manager.

We protect your students' and families' data so you can innovate in the classroom without legal risk.

Comprehensive GDPR adequacy for gyms and fitness centres: access biometrics, mandatory DPIA, a non-biometric alternative, health data and CCTV, with support from Summum Consultoría.

GDPR adequacy for hospitality businesses: bookings, guest registration, CCTV and loyalty programmes for restaurants, hotels and tourist accommodation.

GDPR adequacy for real estate agencies: engagement letters, CRM, data transfers between parties and commercial communications compliant with the LSSI, with expert support across Castilla y León and the Canary Islands.

Tailored GDPR compliance for clinics and healthcare centres: documentation, protocols and an external DPO without disrupting patient care.

Data protection support for companies and SMEs in Burgos and Castilla y León: GDPR adequacy, outsourced DPO and incident management with local presence and ongoing support.

GDPR consulting in Las Palmas de Gran Canaria: support with regulatory adequacy, outsourced DPO and data protection for Canary Island companies, with remote support and occasional on-site visits.

Data protection consulting in León: we support SMEs and freelancers in León with GDPR and LOPDGDD adequacy, with periodic in-person support and permanent remote support.

Data protection consulting in Palencia: GDPR adequacy, outsourced DPO and support for the Palencia business community, with in-person and remote support.

Data protection support for SMEs, practices and clinics in Salamanca: GDPR and LOPDGDD adequacy with in-person and remote support from Castilla y León.

Expert data protection support for companies and institutions in Tenerife: GDPR adequacy, outsourced DPO and ongoing privacy management from the Canary Islands.

Data protection consulting in Valladolid: GDPR adequacy, outsourced DPO and in-person or remote support for SMEs and organisations in Castilla y León.

The AI Act comes into full force on 2 August 2026 for high-risk systems. We take you to compliance without waiting for a penalty. Consultoría + IA + Calidad cluster.

We coordinate the regulatory and procedural side of NIS2 and DORA; we work directly with Summum Sistemas on the technical side.

Alignment with updated RD 311/2022 across its three categories (Basic, Medium, High). Can be combined with ENS for AI systems.

Criminal risk map, code of ethics, whistleblowing channel compliant with Law 2/2023 and an operational compliance committee.

Whistleblowing channel compliant with Ley 2/2023: full implementation, no unnecessary red tape, ready for the AIPI.

We implement your AML/CFT system so that SEPBLAC finds order, not gaps.

3-year vision, explicit business model, growth levers. Regulation is embedded in the plan, not appended at the end.

Give your company real structure: an operational board, board secretariat and bylaws that open doors to investors and major clients.

Once GDPR compliance matures, governance follows: a data owner per asset, measured data quality, a retention policy and a single catalogue.

Interim management for SMEs in transition: an experienced executive leading finance, operations or transformation, for exactly the time needed.

M&A advisory for SME buy-outs and sell-outs: valuation, due diligence and support through negotiation to closing.

We identify the contract, prepare the bid and take you through to award.

Publish what the law requires, protect what the RGPD restricts, and turn transparency into a competitive advantage with public authorities.

Bring your online store's legal notices up to standard and sell without the risk of penalties.

Bring your product to the European market with the documentary and regulatory support required by CE marking.

Protect your brand, design and invention before a competitor does: we handle registration with the OEPM, EUIPO and WIPO from start to finish.

We unlock the R&D tax deductions and grants your company is already generating without knowing it.

Your equality plan negotiated, audited and registered: turning a legal obligation into a competitive advantage for talent acquisition.

Digital working-time records that pass any inspection — no paper, no spreadsheets, no risk.

Turn sustainability reporting obligations into a real competitive advantage with clients, investors and regulators.

Before the plan,the diagnosis.

Before the plan,
the diagnosis.