Regulatory compliance

Complete implementation of the data protection model: recording of processing activities, risk analysis, impact assessments, information clauses, commission contracts and conservation policy.

Exercise of the function of data protection delegate with the independence and qualification required by the GDPR, including the communication of the appointment to the Spanish Data Protection Agency. We attend consultations, supervise the processing, manage the rights of the data subjects and act as an interlocutor to the supervisory authority.

Periodic review of compliance in the area of data protection, both of the organization itself and of its suppliers. We contrast the actual treatments with the approved documentation, evaluate the security measures implemented and deliver a report with the prioritized findings and a correction plan with deadlines and responsible.

Immediate assistance in the event of an incident affecting personal data: containment, risk analysis for those affected, notification to the Spanish Data Protection Agency within 72 hours and communication to the interested parties when appropriate. We also prepare the protocol of gaps and the previous drills, which is where the quality of the response is decided.

Design, implementation and revision of the model of organization and management that allows the company to prevent the commission of crimes and to prove its diligence before a possible criminal procedure. We prepare the map of criminal risks, the associated controls and the protocol of action of the compliance body, and accompany the management in its follow-up.

Adaptation to Law 10/2010 for obliged subjects: prevention manual, client admission policy, due diligence procedures and designation of representative to the SEPBLAC. We also assume the annual training of the staff and the coordination of the mandatory external examination, as well as the response to information requirements.

Implementation of the internal system of information required by Law 2/2023: channel of receipt, policy, procedure of management and designation of the head of the system. We deal with the processing of associated data and, when the company prefers it, the externalized management of the received communications.

We also take the lead in internal investigations into complaints, detected irregularities or incidents with reputational impact.We define the investigation plan, practice interviews and documentary review with the required labour and data protection guarantees, and issue a report of conclusions that can be used against third parties.

Drafting and updating of the ethical code and the body of policies that develops it: conflicts of interest, gifts and attentions, relationship with third parties, use of technological means or anti-corruption.

Compliance with Regulation (EU) 2024/1689 in accordance with its implementation schedule: inventory of artificial intelligence systems, classification by risk level, determination of the role of the company as supplier or responsible for deployment and obligations arising therefrom.

Definition of the internal framework for the use of artificial intelligence: use policy, supervisory body, criteria for approval of cases of use and controls on confidentiality, intellectual property and automated decisions. It allows the company to incorporate these tools without transferring legal risk to its daily operation.

We design training actions so that legal obligations do not remain solely in the documentation. Training allows procedures to be integrated into daily work and that regulatory compliance is part of the company’s usual activity.