Independent consulting in marketing, regulatory compliance (ISO, ENS, GDPR), digitization and B2B sales from Aranda de Duero (Castilla y Leon) covering all of Spain.
Independent consulting in marketing, regulatory compliance (ISO, ENS, GDPR), digitization and B2B sales from Aranda de Duero (Castilla y Leon) covering all of Spain.
GDPR (RGPD in Spain), NIS2, DORA, MAGERIT risk analysis (Spanish public-sector methodology), security master plan, incident management and data protection officer (DPO). For private organisations, public bodies and essential service providers.
Spanish and European cybersecurity regulation has grown enormously: GDPR (2018), LOPDGDD (2018, the Spanish data protection act), National Security Framework (2010 + 2022 update), NIS2 (transposition 2024-25), DORA (2025). Each one has its own scope and specific obligations.
My job: help you understand what actually applies to you, in what order to tackle compliance, which controls are critical and which are cosmetic, and how to demonstrate it when audit time comes.
It applies as long as you serve Spanish customers or process Spanish data; the framework is mandatory above thresholds we summarise in the table.
Indicative ranges for SMEs 10-50 employees: 2,500-12,000 EUR for documentation + auditor fees vary by AENOR / BV / SGS / LRQA.
BOE references RD 311/2022 (ENS), Regulation EU 2016/679 (GDPR), LOPDGDD, NIS2, DORA and the EU AI Act 2024/1689 depending on scope.
Average runs 4-7 months for a single ISO. Compound integrated SGI (9001+14001+27001) usually 8-12 months.
Yes, Kit Consulting 2026 covers up to 24,000 EUR in advisory hours; Kit Digital covers tools (CRM, ERP, ciberseguridad) up to 29,000 EUR.