What I bring
Judgement for decisions where data, technology, security and legal impact meet.
Most digital risks do not live in one department. They appear between contracts, processes, systems, providers, people and evidence. That is where my profile is most useful.
Management, legal and IT in the same conversation
I translate technical risk into business decisions and turn legal obligations into measures a technical team can execute.
Compliance connected to real operations
Having texts is not enough. What matters is that what the company says, what it does and what it can prove are aligned.
Evidence prepared before the conflict
When there is a complaint, inspection or court case, details matter: logs, metadata, chain of custody, signatures and documented decisions.
Background
More than two decades around code, systems, security and responsibility over data.
My base is technical: Java/J2EE architecture, development, integration, performance, systems, automation and security. That experience changes the way privacy is handled: I do not start only with clauses, but with processes, access, providers, logs, backups, cameras, AI and real decisions.
On that base I add data protection, cybersecurity, ENS/ISO 27001, the AI Act and IT expert work. That lets me speak to management with clarity, to lawyers with precision and to technical teams without staying in theory.
Experience map
A hybrid profile for companies that need order, security and the ability to explain decisions.
Governance of processing activities, breaches, providers, rights, CCTV and compliance evidence.
Assets, access, hardening, risks, controls, traceability, incident response and audit readiness.
System classification, governance, privacy by design, AI in CCTV and automated decisions.
PDFs, metadata, electronic signatures, WhatsApp, chain of custody, expert reports and testimony when applicable.
More than 20 years in development, integration, performance, systems and software connected to real business processes.
Prioritising measures, reducing risk, supporting providers and making decisions understandable for management.
Verifiable credentials
Credentials that can be checked, not just displayed on a website.
AEPD-DPO Scheme · Registry A2025166DPD
Individual DPO certification under the AEPD-DPO Scheme, promoted by the AEPD to evidence professional qualification and verifiable on the Agency's electronic site.
AEPEJU · TIP 639
Spanish Association of Judicial Experts. 16 accredited expert categories: computer forensics, security and privacy, civil and criminal expert reports, etc.
Public professional profile with experience, training and recommendations. Recommended for law firms, managers and legal teams that want to verify background and context.
Working model
A method designed so management can decide and the team can execute.
I review processes, data, owners, providers, tools, access and available evidence.
I identify what is urgent, what is structural and what can become a problem in a complaint or audit.
I prioritise realistic actions, with clear deliverables and useful language for management, legal and IT.
I document decisions, controls and results so the work can be explained to clients, audits, the AEPD or a court.
Frequently asked questions
Frequently asked questions
Who signs the deliverables?
All reports, opinions and proposals are signed by Manuel Navarro Rajoy. There is no hidden subcontracting nor delegation to juniors: the professional who analyses the case is the same one who testifies in court when applicable.
Where can I verify the credentials?
Individual DPO certification under the AEPD-DPO Scheme can be verified on the AEPD electronic site (registry A2025166DPD). The Court-appointed IT Expert accreditation can be verified at AEPEJU (TIP 639).
What is the base education?
Technical Engineering in Management Computing, more than 20 years in systems and development, training as AEPD Expert in Data Protection, Court-appointed IT Expert AEPEJU and continuous training in ENS, ISO 27001, AI Act and advanced privacy.
Do you only serve Barcelona?
The office is based in Badalona (Barcelona) but we serve clients throughout Spain. Video meetings are the default option, on-site presence when the case requires it.
Let us speak clearly
If the issue mixes data, systems, security or AI, it should be examined as a whole.
Tell me the context and I will point out what I would review first, what evidence should be preserved and what decision management should take.
