Sonia Gracia Castellón

I am a Director in the Tech & Data practice at Fieldfisher Spain, specialising in data protection, digital regulation, and intellectual and industrial property.

With more than 13 years of experience, I advise public and private organisations — both national and international — on complex data protection and digital law matters, combining regulatory expertise with a strong focus on technology and innovation. My work spans GDPR compliance and broader EU digital regulation, including the AI Act, Data Act, and the European Health Data Space framework, as well as intellectual property, e-commerce, outsourcing, and IT-related matters. I also act as external Data Protection Officer (DPO) for clients.

I support organisations in designing and implementing compliance programmes, structuring technology and IT contracts, and advising on the legal aspects of digital products and platforms, including e-commerce ecosystems, marketplaces, and applications. 

I have developed a broad sectoral experience working with clients in life sciences, healthcare, NGO, retail, marketing, public administration and technology, from early-stage businesses to established multinational groups.

My practice is centred on understanding each client’s business model and strategic priorities, allowing me to deliver pragmatic, business-oriented legal advice that enables compliance while supporting innovation and digital growth.

I hold a Law degree from Pompeu Fabra University and a Master’s in Intellectual Property and the Information Society from ESADE. I am a practising lawyer at the Barcelona Bar Association and actively engaged in its professional training and development activities.