Cynthia

Cynthia concentrates her practice in the areas of personal data protection, cybersecurity and artificial intelligence, with international experience.

Cynthia offers specialist legal advice on the protection of personal data and the regulation of new technologies. She has experience advising diverse domestic and international companies on the interpretation and application of Ecuador’s Personal Data Protection Law and its impact on different industries.

She is part of the teams that comprehensively advise on the implementation of privacy programs, including the execution of impact assessments, analysis of international data transfers, and the adoption of database security measures. Additionally, she has extensive knowledge in security incident management and the design of strategies in general and disciplinary procedures at the administrative and contentious-administrative level.

Cynthia has expertise in advanced technology compliance and risk management and has conducted cybersecurity maturity assessments for high-level clients, using recognized frameworks like ISO 27001 and NIST to identify gaps and propose mitigation plans. This work includes defining governance frameworks for data protection and preparing executive assurance reports to assess risk exposure and support the strategic procurement of cybersecurity policies. In addition, she has experience in compliance with critical European regulations such as the NIS2 Directive and the Digital Operational Resilience Act (DORA). In the field of artificial intelligence (AI), Cynthia has developed protocols for responsible use in accordance with ISO 42001 and she has worked on the assessment of risks arising from the EU Artificial Intelligence Act, ensuring the integration of security, innovation and regulatory compliance criteria.