Home / People / Miguel Recio
Portrait ofMiguel Recio

Miguel Recio


CMS Albiñana & Suárez de Lezo
Paseo de Recoletos 7–9
28004 Madrid
Languages Spanish, English

Miguel Recio is an Associate of the TMC department at CMS Albiñana & Suárez de Lezo, specialising in personal data protection and e-commerce.

He possesses vast experience as a specialist lawyer in ICT and, most notably, in advising on the creation of data protection compliance programmes and policies, privacy policies, the alignment of purchasing processes to the applicable legislation and the requirements imposed on service providers under the Spanish Information Society Services Act. 

He carried out his PhD thesis on data protection officers and relevant questions for the development of their future legal status at Universidad CEU San Pablo under the supervision of José Luis Piñar Mañas (cum laude distinction).

He is an associate professor of the Law Faculty at Universidad CEU San Pablo, lecturing on ICT management, cybersecurity and ethical hacking. He is also a member of the group of lecturers for the International Master's Degree in Data Protection, Transparency and Access to Public Information.

Holds the certification ECPP-DPO Senior of the Spanish Privacy Association (APEP).

more less

Relevant experience

Miguel advises leading national and internacional companies on a daily basis on data protection, privacy and techology matters, including the creation of data protection policies and the implementation of procedures aimed at developing compliance programmes, advice on the implementation to the GDPR and other local data protection regulations around the globe, including obtaining authorisation for international data transfers, defence in sanctioning proceedings before the Spanish Data Protection Agency, in-house training on personal data protection and cybersecurity and analysis on draft data protection regulations, among others.

more less

Memberships & Roles

  • Member (Second Vicepresident) of the Spanish Privacy Association (APEP).
more less


  • He regularly collaborates with general and specialised media in his area of ​​practice, publishing on matters such as technology, e-commerce, data protection and privacy.
more less

Lectures list

  • Miguel has presented on personal data protection, cloud computing and cybersecurity at countless national and international conferences.
more less


  • Master´s Degree in Public Administration and Management, Universidad de Castilla-La Mancha (Spain).
  • Doctor of Law with thesis entitled "Analysis of data protection officers and relevant questions for the development of their future legal status", Universidad CEU San Pablo, Madrid (Spain).
  • 2014 - Master's Degree in Data Protection, Transparency and Access to Public Information, Universidad CEU San Pablo, Madrid (Spain).
  • 2008 - LL.M. in Intellectual Property, George Washington University Law School, Washington (United States). 
  • 2000 - Graduate of Law, Universidad Carlos III, Madrid (Spain).
more less


CJEU provides clarity on data protection: judgments on right to compensation...
CJEU judgment on right to compensation for non-material damage under GDPR (Case C-300/21)On 4 May 2023, the CJEU delivered a judgement concerning the right to compensation following an infringement of...
European Parliament opposes EU-U.S. Data Privacy Framework proposal
Miguel RecioThe European Commission´s proposal for an adequacy decision on the EU-US Data Privacy Framework, which is in the process of being adopted, has been deemed unsatisfactory by the European Parliament´s...
Act regulating the protection of persons who report breaches of the law...
Law 2/2023, of February 20, 2023, which protects persons who report breaches of the law and on combatting corruption, was published in the Official State Gazette (BOE) on 21st of February and will enter...
Brexit: implications for data protection
Miguel Recio On the 24th of December 2020, the European Union (EU) and the United Kingdom reached a last-minute deal on Brexit. Interestingly, the UK-EU Trade and Cooperation Agreement is the first time...
International data flows after Schrems II: challenges and solutions
CMS Spain invites you to join a webinar in English and Spanish, which will analyse the latest developments in international data transfers in the EU, including the Schrems II case and Brexit.  The Schrems...
Guide on international data transfers – Drawing on the Schrems II Case
On 16 July 2020, almost five years after the Safe Harbour Agreement between the European Union and United States was ruled invalid, the Court of Justice of the European Union delivered a judgment on...
General Data Protection Regulation: two years of accountability
The date 25 May 2020 marks the second anniversary since the General Data Protection Regulation (GDPR) became applicable, representing a shift from a compliance verification approach to an ac­count­ab­il­ity-based...