Gregorio Barco

Data Protection and Privacy

Digital Law and Technology Regulation

Artificial Intelligence Governance

Cybersecurity and Incident Response

Privacy and Data Governance

Cross-Border Data Transfers

Biometrics and Sensitive Data

Privacy Impact and Risk Assessments

Data Processing Agreements and Vendor Governance

Data Subject Rights and Regulatory Compliance

Digital Platforms and E-Commerce

Digital Advertising, Cookies and AdTech

Electronic Signatures, E-Contracts and Digital Evidence

FinTech and Digital Financial Services

Technology Transactions and Outsourcing

Specialist in privacy, personal data protection, and technology regulation, with over a decade of experience. Lawyer with expertise in Digital Law, Artificial Intelligence, Technology, and Innovation, and Director of the Research, Development & Innovation (R&D&I) department at Davara Abogados.

Author of the book The Role of the Privacy Professional in Latin America: Current Status and Challenges for Effective Operation (INAI, 2023) and co-author of key works on data protection, artificial intelligence, FinTech, and technology law. I advise clients in Mexico, Latin America, and Europe, focusing on industries such as FinTech, telecommunications, artificial intelligence, and the digital economy.

Senior Attorney and Director of Research, Development and Innovation, Davara Abogados – Mexico City, Mexico | 2014–Present

Gregorio Barco is a senior attorney with more than 12 years of specialised experience in digital law, privacy, data protection and emerging technologies. He combines strategic legal advice with a practical understanding of technology and its application in highly regulated environments.

Author of the book “The Role of the Privacy Professional in Latin America: Current Landscape and Key Challenges for Effective Operation” (INAI, 2023).

Co-author of multiple works on privacy, technology, and regulatory topics, including “15 Years of the Federal Law on the Protection of Personal Data in Mexico: Told by Its Protagonists” (2025); “Artificial Intelligence: Concept, Legal Implications, Challenges, Ethical Questions, Where We Are Heading and Much More…” (2023); GPS FinTech, Professional Guide (2022); GPS on Personal Data Protection for the Private Sector (2020); Dictionary of Personal Data Protection (2020); Digital Threats in the Business Environment (2020); Legal Implications of ICTs (2019); FinTech: In-Depth Analysis of Innovations in the Financial Services Industry, Including Legal, Tax, and Anti-Money Laundering Regulation (2019); How to Ensure Personal Data Protection: Auxiliary Guide for Diagnosing and Complying with Data Protection Legislation within Organizations (2017); The World of E-Commerce Under the Law (2017); The Human Right to Personal Data Protection in Mexico (2016), among others.

Gregorio has advised leading domestic and multinational organisations operating in highly regulated and technology-intensive sectors, including telecommunications, digital platforms, financial services, aviation, healthcare, pharmaceuticals, insurance, retail, e-commerce and technology.

Gregorio is recognised for his hands-on, analytical and technology-oriented approach. He combines strong subject-matter expertise with the ability to understand complex operational environments and translate regulatory requirements into clear, actionable and commercially workable solutions. His professional interests include responsible artificial intelligence, privacy engineering, digital identity, electronic contracting and the use of technology to improve legal and compliance functions.

AI governance framework for a global technology company

Played a central role in developing the risk assessment methodology and audit tools supporting a comprehensive AI governance framework for a global technology company. Gregorio analysed the interaction between artificial intelligence, data protection, transparency and explainability requirements, helping translate international principles into practical controls for products, services and internal operations.

Large-scale data subject rights programme for a leading telecommunications company

Supports the legal management of a high-volume programme involving thousands of data subject rights requests each year. Gregorio handles complex cases, monitors statutory deadlines, maintains compliance controls and prepares internal reports. His work has helped the client establish a consistent and legally robust methodology for responding to access, rectification, cancellation and objection requests while reducing regulatory and reputational risk.

Multi-jurisdictional privacy framework for an international airline

Contributed to the design of a privacy and contractual framework for an international airline working with insurance providers across more than 20 jurisdictions. Gregorio analysed data processing agreements, controller and processor roles and international data transfer requirements. His work supported the development of a consistent contractual model capable of addressing diverse regulatory requirements without compromising the project’s commercial viability.

Gregorio Barco is a Senior Attorney and Director of the Research, Development and Innovation Department at Davara Abogados, a specialist Mexican boutique focused on Digital Law, Technology and Innovation.

He provides strategic advice on privacy, data protection, cybersecurity, regulatory compliance, artificial intelligence, FinTech, electronic contracting and telecommunications. His work includes designing compliance programmes, conducting privacy and risk assessments, reviewing international data transfers, handling complex data subject rights requests, drafting technology agreements and supporting regulatory investigations and litigation.

Gregorio has also contributed to the development and analysis of key Mexican data protection legislation, including the legal frameworks applicable to both the private and public sectors. He combines legal analysis with technological knowledge to develop practical, results-oriented solutions for organisations operating in highly regulated environments.

Since 2017, he has taught in ITAM’s Diploma Programme in Digital Law, Technology and Innovation. He is also a regular trainer, speaker and panellist on privacy, artificial intelligence and electronic contracting at specialised national and international forums.

Universidad Nacional de Educación a Distancia

University Specialist and Expert in the European Union General Data Protection Regulation

2020 - 2020

National Autonomous University of Mexico

Master of Laws

2016 - 2018

National Autonomous University of Mexico

Bachelor of Laws

2011 - 2014

Gregorio advises organisations on privacy governance, regulatory compliance, international data transfers, data processing agreements, data subject rights, privacy impact and risk assessments, cybersecurity incidents, electronic signatures, digital evidence and technology contracts.

He has particular experience in artificial intelligence governance, including risk classification, impact assessments, transparency, human oversight and the responsible use of automated systems. His practice also encompasses FinTech, telecommunications regulation, digital identity and the implementation of technology-enabled privacy programmes.

Mexico; Spain; Latin America; European Union; United States.

Gregorio has participated in international compliance projects involving operations across Latin America, the United States and Europe. His work includes analysing cross-border data flows and aligning Mexican privacy requirements with the GDPR and other international regulatory frameworks.