Law firm: M&C Abogados (Apna Advocats SLP)

Version: 1.0

Approval date: 2025-06-26

Approved by: Diana Caballero Aguirre, CEO and Information Security Officer

Confidentiality level: Internal

1. Introduction

Information and the systems that manage it are critical assets for M&C Abogados. The growing reliance on digital technologies, the processing of sensitive data, and the need to maintain clients’ trust require the establishment of a formal security policy. This policy defines the principles, roles, responsibilities, and controls necessary to protect information against internal and external threats.

2. Mission and objectives

The mission of this policy is to ensure the confidentiality, integrity, availability, authenticity, and traceability of the information handled by the firm. Its main objectives are:

• Comply with applicable regulations (GDPR, LOPDGDD, LSSI).
• Minimise the risks of data breaches or data loss.
• Ensure operational continuity.
• Raise the team’s awareness of its role in protecting information.
  
  

3. Scope

It applies to all systems, people, devices, and processes involved in the processing of information at M&C Abogados. It includes both digital and paper-based information, regardless of its format or medium.

4. Regulatory framework

This policy is based on:

• Regulation (EU) 2016/679 (GDPR).
• Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights.
• Law 34/2002 (LSSI).
• Principles of the ISO/IEC 27001 standard.
  
  

5. Information classification

The firm’s information will be classified into three levels:

• Confidential: case files, health data, minors, criminal proceedings.
• Internal use: internal communications, human resources, working documents.
• Public: content published on the website and social media.
  
  

6. Security organisation

• Security Officer: Diana Caballero Aguirre (CEO).
• Data Protection Officer: Equal Protección de Datos (external).
• Digital channels lead: Digital marketing lead.
• IT support: external provider, engaged on an ad hoc basis.
  
  

All staff are responsible for complying with this policy and reporting incidents or weaknesses.

7. Risk management

Although no formal audit has been carried out, the firm undertakes to:

• Review risks at least once a year.
• Respond to incidents affecting security.
• Assess technological or regulatory changes.
  
  

8. Technical controls and access

• Strong passwords and two-factor authentication.
• Encrypted storage in Google Drive and OneDrive.
• Website protection with Wordfence and Limit Login Attempts.
• Controlled remote access and responsible use of personal devices.
  
  

9. Incident management

Incidents must be reported immediately to the Security Officer. Their impact will be assessed and, where applicable, the AEPD will be notified. All cases will be documented to prevent future recurrence.

10. Relationship with third parties

Third parties who access the firm’s data must sign confidentiality agreements and comply with this policy. At the end of the relationship, they must delete all information under auditable guarantees.

11. Training and awareness

All team members will receive annual basic training in cybersecurity, best practices, and data protection. An active security culture will be promoted.

12. Updating and continuous improvement

This policy will be reviewed annually or when relevant changes occur. All modifications will be approved by Management and communicated to staff.

13. Supporting documentation

This policy will be implemented through:

• Internal security rules.
• Secure working procedures.
• Best-practice guides for employees.
  
  

Approved by:

Diana Caballero Aguirre
CEO and Information Security Officer