Informational purpose
This tool has an informational and general guidance purpose. It allows a director to understand, in a few minutes, what the Spanish courts will require if the company suffers a security breach: not infallibility, but proof that it acted with diligence.
It is a starting point for a conversation. It is not the end of an analysis.
It does not constitute legal advice
The content of this site and the test result do not constitute legal advice and do not replace a review of your case by a professional.
An opinion requires reading your actual contracts, your processor agreements with providers, your internal protocols, your records and your files. None of that happens here: the tool does not see a single document of yours.
It is not a security audit
What it measures is something else: whether, if the day comes, your company could evidence before a judge what it did, when it did it and who decided it. A company may be well protected and still fare badly in the test if it keeps no written trace of it; and conversely, a good file does not replace the measures that must exist.
That is why the result must not be presented as a security warranty to clients, insurers, auditors or the supervisory authority.
It does not create a lawyer-client relationship
Your use of it does not create a lawyer-client relationship with ILP Abogados. No professional engagement, no duty of defence and no duty to follow up your matter arises from it.
The information you enter in the test is not covered by legal professional privilege, because no professional relationship yet exists to trigger it. Do not include in the open fields any confidential data, details of an actual incident, names of affected individuals or information about ongoing proceedings.
If you want your case to be genuinely reviewed, write to us at info@ilpabogados.com and we will channel the engagement through the proper route.
Verify the references against the official texts
The legislative and case-law references you will see must be verified against the official texts before taking any decision.
Judgments are cited in abbreviated form and for their reasoning, not in their full wording. A decision may have been appealed, qualified or superseded by a later one, and the doctrine of the Provincial Courts of Appeal (Audiencias Provinciales) is not uniform throughout the country. Always check against the Official State Gazette (Boletín Oficial del Estado) and the search service of the General Council of the Judiciary (Consejo General del Poder Judicial).
How your result is calculated
The results are calculated from the answers you provide, without reviewing your actual documentation, and are therefore necessarily indicative.
The engine checks nothing: it takes every answer at face value. If you answer that your response protocol is in writing and dated, the calculation assumes it is. An optimistic answer produces an optimistic result, and an imprecise answer produces an imprecise result.
That is why “I do not know” counts as a risk: in this field the burden of proof falls on your company, and what cannot be evidenced behaves, before a judge, as if it did not exist.
The Defensibility Index is indicative
The Defensibility Index and the level that accompanies it are a guidance signal, not a forecast. They do not predict the outcome of a judgment, they do not measure your actual level of risk and they are not equivalent to a compliance diagnosis.
What a court ultimately decides depends on circumstances this tool does not know: what exactly happened, how many people it affected, what data was involved, how your company reacted and how quickly, what it was able to prove and what it was not, and the approach of the particular Provincial Court of Appeal.
Do not use this result as the basis for an investment decision, a negotiation, a due diligence exercise, an insurance policy or a report to your board without a professional reviewing it first.
This statement authorises nothing regarding your data
This statement is independent of any consent regarding your data: accepting it authorises no processing. Your data protection decisions are requested separately, purpose by purpose, and you may change them whenever you wish from the footer.
You can consult them in the privacy policy.
Limitation of liability
ILP Abogados is not answerable for the decisions you take, or fail to take, on the sole basis of the content of this site or of the test result. The general terms of use are set out in the legal notice.
Text version: 2026-08-06-borrador-1.
Text version: 2026-08-06-borrador-1