Data and digital business

I run a data-driven digital company and I fear I am not managing the risk well

For digital companies that live on data and want EU regulatory risk managed as a business decision.

§ 1

Proposal

Digital law is the law of data.

The map comes first

Data enters through a form, passes through several suppliers and crosses the Atlantic. We map that journey before drafting a single clause.

Beyond the GDPR

The Data Act, NIS2 and communications privacy are also decided in Brussels. We read your customers’ contracts before you sign obligations the law does not impose on you.

Compliance built in

Our own systems are built with privacy by design. What we recommend to you, we already run ourselves.

We read code and architectures

We audit how your data really flows through your product, without technical intermediaries.

§ 2

Articles

What we write about this.

We write about the work we do. Reading these articles is the fastest way to see how we think before you hire us.

§ 3

LUDUS

Check where you stand before spending a euro.

Free LUDUS games, no sign-up, built on the same rules we work by. If your case does not need a lawyer, they will tell you.

It tests your eye for telling GDPR infringements apart from compliant practice.

§ 4

Services

Choose the engagement that fits your case.

Each service has a fixed scope and a published starting price. The exact amount, with foreseeable costs, is set out in the engagement letter.

Startups

Shareholders' Agreement

You will get your shareholders' agreement and the assignment of your code.

From
€1,500 + VAT
2 weeks
Startups not yet incorporated

Startup Incorporation

We will incorporate your company, draft its agreement and file its trade mark.

From
€3,000 + VAT
3 weeks
Companies under investigation

AEPD Defence

We will draft your submissions in time and weigh the reduction with you.

From
€1,500 + VAT
Per case timetable
Companies facing a breach

Data Breach Response

We will notify the AEPD and inform those affected where the law requires it.

From
€2,500 + VAT
72 hours
EU digital companies

GDPR Product Audit

You will receive the real map of your data and the documentation behind it.

From
€3,500 + VAT
3 weeks
Software manufacturers

Cyber Resilience Act

You will receive your reporting protocol, update policy and contracts.

From
€3,500 + VAT
3 weeks
Game studios

Games for Children

Your game will be assessed by lawyers against EU child protection rules.

From
€4,500 + VAT
3 weeks
SaaS and cloud providers

Data Act for SaaS

You will receive your terms, your exit plan and the pre-contract information.

From
€4,500 + VAT
3 weeks
Investors and startups

Tech Due Diligence

You will receive a legal risk map with a prioritised list of remedies.

From
€5,000 + VAT
2 weeks
Non-EU companies

GDPR for Non-EU Companies

You will know how far the GDPR reaches you and receive the documents you need.

From
€4,500 + VAT
2 weeks

§ 5

Lawyers

Choose who you want to speak to.

Book directly with whoever you prefer. If you have not decided, we will assign a lawyer when you book the Virtual Consultation.

Guillermo Passas Varo, founding partner of PASSAS
Founding Partner

Guillermo Passas Varo

LinkedIn Circle
Colegiado ICAGR
7941

I see legal practice as a discipline of precision. I work where the law meets technology and cross-border operations, and I read code and contracts with the same attention. Before accepting an engagement I tell you whether it is worth pursuing and what it costs, at a fixed price.

David Sánchez Lorenzo, of counsel at PASSAS
Colegiado ICAGR
8281

I work where economic law meets technology: litigation, contracts and artificial intelligence systems. I am drawn to the ground where the rules are still being written, and I have brought that same rigour to litigation since my first year in practice.

§ 6

Questions

What to know before you book.

Is a published privacy policy enough?

The policy describes what you do, and what gets reviewed is whether your product handles data the way it says.

That is why we start with the real data-flow map. The GDPR Product Audit delivers it in three weeks, with the documentation to back it up.

I have received a request from the Spanish Data Protection Agency. What should I do?

Reply within the deadline with well-built submissions. Our AEPD Defence starts at €1,500 + VAT.

The file sets the deadlines. The sooner you send it to us, the more room we have to assess a reduced penalty with you.

We have suffered a data breach. How much time do I have?

When notification is required, the authority must receive it within 72 hours of you becoming aware.

Our Data Breach service notifies the authority and informs the people affected when required. If you are within that window, book the consultation today or tell us about your matter.

What if there is no engagement after the consultation?

You keep our view on your case and pay nothing more.

If your case does not need a lawyer, we will tell you during the consultation. If it does, you will receive an engagement letter with a fixed price before you pay anything else.

Book your Virtual Consultation today.

Sixty minutes on Google Meet with a qualified lawyer. It costs €90 including VAT and will be deducted from the first invoice if an engagement follows.

Book a Virtual Consultation (€90)Tell us about your matter first

If you book, you will choose your lawyer and a time in Google Calendar. If you would rather tell us about your matter first, we will reply within 24 working hours.