Enrique Gallego Capdevila

Enrique is a trilingual special counsel with extensive experience in data protection and cybersecurity law. He provides strategic advice to international clients on a broad spectrum of digital-related issues, concentrating on the new European Union digital, data and cybersecurity regulations – including the Artificial Intelligence (AI) Act, Data Act, Digital Services Act (DSA), Network and Information Security (NIS) 2 Directive, Digital Operational Resilience Act (DORA), etc. – as well as General Data Protection Regulation (GDPR) implementation, ecommerce and adtech.

Ranked as a “rising star” in several legal directories, Enrique excels in guiding clients through the complexities of EU digital regulations and data privacy and cybersecurity laws – particularly in the context of strategic transactions, such as mergers and acquisitions (M&A), partnership agreements, public offerings and private financings. Additionally, he advises on privacy and employment matters and on the interplay between privacy and payments regulations.

Before joining Cooley, Enrique was a senior associate in the data privacy and cybersecurity practice at a globally recognized top 10 law firm.

Enrique is qualified to practice in Spain and Belgium and regularly advises clients on European and Spanish data protection matters.

Enrique’s representative experience includes:

• Leading GDPR compliance implementation projects across multiple jurisdictions in the EU and assisting in carrying out detailed gap analysis assessments, along with remediation and implementation processes
• Assisting several clients in the design and implementation of global privacy programs, including drafting policies, contractual documents and other relevant materials
• Advising a global marketplace on the negotiation of complex agreements with payment service providers
• Assisting a social media platform on regulatory investigations initiated by different European supervisory authorities regarding the processing of special data categories
• Assisting several clients after security incidents and data breaches, providing advice regarding their data breach notification obligations before various European supervisory authorities