What I bring
Judgement for decisions where data, technology, security and legal impact meet.
Most digital risks do not live in one department. They appear between contracts, processes, systems, providers, people and evidence. That is where my profile is most useful.
Management, legal and IT in the same conversation
I translate technical risk into business decisions and turn legal obligations into measures a technical team can execute.
Compliance connected to real operations
Having texts is not enough. What matters is that what the company says, what it does and what it can prove are aligned.
Evidence prepared before the conflict
When there is a complaint, inspection or court case, details matter: logs, metadata, chain of custody, signatures and documented decisions.
Background
More than two decades around code, systems, security and responsibility over data.
My base is more than 20 years designing and deploying security and control systems: Java and J2EE architecture, development, integration, performance, systems, automation and security. That experience changes the way privacy is handled: I do not start only with clauses, but with processes, access, providers, logs, backups, cameras, AI, real decisions and technical exposure when it makes sense to test it with authorisation.
On that base I add data protection, cybersecurity, ENS/ISO 27001, the AI Act and IT expert work. That lets me speak to management with clarity, to lawyers with precision and to technical teams without staying in theory.
Experience map
A hybrid profile for companies that need order, security and the ability to explain decisions.
Governance of processing activities, breaches, providers, rights, CCTV and compliance evidence.
Assets, access, hardening, risks, controls, traceability, incident response, ENS and ISO 27001 and authorised pentesting when the scope is signed.
System classification, governance, privacy by design, AI in CCTV and automated decisions.
PDFs, metadata, electronic signatures, WhatsApp, chain of custody, expert reports and testimony when applicable.
More than 20 years in development, integration, performance, systems and software connected to real business processes.
Prioritising measures, reducing risk, supporting providers and making decisions understandable for management.
Verifiable credentials
Credentials that can be checked, not just displayed on a website.
AEPD-DPO Scheme · Registry A2025166DPD
Individual DPO certification under the AEPD-DPO Scheme, promoted by the AEPD to evidence professional qualification and verifiable on the Agency's electronic site.
AEPEJU · TIP 639
Spanish Association of Judicial Experts. 16 accredited expert categories: computer forensics, security and privacy, civil and criminal expert reports, etc.
Public professional profile with experience, training and recommendations. Recommended for law firms, managers and legal teams that want to verify background and context.
Working model
A method designed so management can decide and the team can execute.
I review processes, data, owners, providers, tools, access and available evidence.
I identify what is urgent, what is structural and what can become a problem in a complaint or audit.
I prioritise realistic actions, with clear deliverables and useful language for management, legal and IT.
I document decisions, controls and results so the work can be explained to clients, audits, the AEPD or a court.
Philosophy
How I see this work
Behind every service there is one idea: compliance that is real, useful and demonstrable, not a facade. That is my mission, my vision and my values.
See mission, vision and values
Frequently asked questions
Frequently asked questions
Who signs the deliverables?
All reports, opinions and proposals are signed by Manuel Navarro Rajoy. There is no hidden subcontracting nor delegation to juniors: the professional who analyses the case is the same one who testifies in court when applicable.
Where can I verify the credentials?
Individual DPO certification under the AEPD-DPO Scheme can be verified on the AEPD electronic site (registry A2025166DPD). The Court-appointed IT Expert accreditation can be verified at AEPEJU (TIP 639).
What is the base education?
Technical training in management computing, more than 20 years designing and deploying security and control systems, training as AEPD Expert in Data Protection, Court-appointed IT Expert AEPEJU and continuous training in ENS, ISO 27001, AI Act and advanced privacy.
Do you only serve Barcelona?
The office is based in Badalona (Barcelona) but we serve clients throughout Spain. Video meetings are the default option, on-site presence when the case requires it.
Do you also carry out pentesting and Red Team work?
Yes, as authorised offensive security, with a contract, signed scope and clear limits. The difference is combining the technical test with compliance judgement, evidence and an explanation that is useful for leadership.
Let us speak clearly
If the issue mixes data, systems, security or AI, it should be examined as a whole.
Tell me the context and I will point out what I would review first, what evidence should be preserved and what decision management should take.
