Ecix Group, S.L.

Ecix Madrid: C/ Lagasca, 88 – 7ª Planta, 28001 Madrid Ecix Barcelona: Passeig de Gracia 101, 2-1, 08008 Barcelona Ecix Group is a reg tech and legal services firm specialized in privacy and personal data protection advisory services, AI-powered solutions, cybersecurity, compliance and Legal Operations for large organizations. Since 2012, we have been transforming the legal sector through innovation and technology. We help companies prevent and manage legal and regulatory risks through services and technology in Privacy, Compliance, Digital Law, Cybersecurity, and AI law, combining legal expertise with mathematical risk models and state of the art legal tech tools that we develop. Our goal: make legal processes smarter, safer, and more efficient. Contact: Tel: +34 910016767 E-Mail: privacidad@ecixgroup.com Web: www.ecixgroup.com Esmeralda Saracíbar is an attorney and specialist in data protection law, and a partner in the Governance, Risk & Compliance area at ECIX. She is part of the legal counsel to leading companies and public administrations on IT security–related matters, large-scale data protection audits, and the implementation of compliance strategies and systems to protect their data. She is a member of the ISMS Forum Spain, the Data Protection Institute, and the Cloud Security Alliance Directors Board in Spain, which are organizations specializing in areas such as IT security, privacy and data protection, and security assurance within cloud computing. Nikola Kovacic is a partner at ECIX GROUP and currently the managing partner for ECIX Barcelona. He specializes in advisory services on privacy, compliance, cybersecurity, AI and regulatory risk. He has assisted principal Spanish and international companies in adapting to regulatory requirements and maintaining a compliance framework. Nikola is a certified DPO by the Spanish Data Protection Agency certification scheme and holds, among other, the CIPP/E certification. He has a special interest in innovation within the legal profession including legal ops and legal tech projects.

Representatives

Nikola Kovacic

partner

Esmeralda Saracibar

member

Contact

Publications

• Mythos and the New Regulatory Challenges of AI-Driven CybersecurityThe emergence of advanced AI models capable of autonomously discovering vulnerabilities is reshaping the regulatory landscape of cybersecurity, privacy and operational resilience. Mythos, Anthropic’s advanced cybersecurity-oriented model, illustrates how AI is rapidly evolving from a productivity tool into a strategic infrastructure with profound implications under the GDPR, the EU AI Act, NIS2 and DORA.9 June 2026
• Due Diligence Obligations in the Spain: Lessons learnt from AEPD Sanctions and future trendsAmid the EU's rapidly evolving due diligence landscape, this article unpacks Spain’s tough stance on data protection compliance and reveals how landmark AEPD fines have sounded a wake-up call: businesses must rigorously vet their third-party providers or face costly consequences.2 September 2025
• Cyberattacks based on the victim´s complianceInformation security compliance has become now a new exploit that cybercriminals are taking advantage from, prompting a need for clear regulatory guidance and proactive security measures.22 January 2024
• WHO IS ACCOUNTABLE WHEN THE COMPANY SUFFERS A CYBERATTACK?Managing cyber attacks has always been a complex task and, in almost every scenario, it implied the dismissal of the CISO of the company. However, as we will see, there are several reasons to conclude that there is no only one person who shall face responsibility.12 January 2024
• Same data protection guarantees around the world?The privacy team of ECIX GROUP has carried out a comparative analysis focused on the existing different data protection regulations thinking in those clients of the firm with an international presence. In addition, you will have access to a map including a comparative analysis between local regulations.2 November 2022
• The destruction of the algorithm: the new sanction for breaching the GDPR?Since 2019, The Federlñ Trade Commission (FTC) has been seeking ways to punish the new digital unfair practices, consisting on illegally obtaining personal information from Internet users and exploit it with artificial intelligence tools. In this case, the punishment consists on what is called “the destruction of the algorithm”.20 May 2022
• 2021 in GDPR finesThe EU General Data Regulation (GDPR) is among the world's toughest data protection laws. In this article you will have a general overview about the fines imposed by control authorities in 2021.21 February 2022
• When AI met privacyHow to fulfil the data protection obligations when using artificial intelligence? One of the main issues of concern is the use of personal information by the algorithms. The European AI industry encourages self-regulation.16 November 2021
• When privacy became an investment risk. Shall companies report its security incidents to the market?Potential investors are being warned of the negative impact that the GDPR sanctions may have on the expected profitability of the business. Cyberattacks on listed companies should be reported to the market as a warning to the investors. Privacy is a business risk, and their management bodies must adopt effective measures to prevent it.12 March 2021