Compliance and data protection

Regulatory compliance stopped being a concern exclusive to large corporations some time ago. Corporate criminal liability, the obligation to operate an internal whistleblowing channel and the GDPR sanctions regime now reach medium-sized and small companies.

Our view on this is firm: a compliance programme copied from a template does not protect anyone. The defence to corporate criminal liability requires a model tailored to the organisation’s real risk, with controls that are genuinely applied and evidence that they are supervised.

Criminal compliance

We identify the offences to which the company’s actual activity is genuinely exposed — usually a limited set — and design proportionate controls over those risks, rather than over the entire criminal code. We define the supervisory body, the disciplinary regime and the evidence system, because what is examined in criminal proceedings is whether the model worked, not whether it existed.

Whistleblowing channel

Spanish Act 2/2023 requires an internal reporting system in companies with fifty or more employees, and in certain sectors regardless of headcount. We implement the channel, the management policy and the internal investigation procedure, with the guarantees of confidentiality and protection against retaliation that the law demands.

Data protection

We approach the GDPR as an information governance project, not a pack of documents: inventory of processing activities, the legal basis for each one, information to data subjects, processor agreements, retention policy, security measures, breach management and handling of data subject requests. We also act as outsourced data protection officer and defend proceedings before the Spanish Data Protection Agency.