Ilma Advisory: data protection and people advice in Malta, Spain and across Europe
Independent advice on data protection (GDPR) and people (HR) for growing companies, from Malta to Spain and across Europe. We bring experience earned inside large international companies: senior judgement, quick answers and advice shaped to you.
What we do
One advisor for questions that rarely arrive alone.
Data protection is the heart of our practice. Alongside it, we advise on people, because the two meet more often than most firms admit. A dispute with an employee soon becomes a request for their data. A privacy specialist misses the dispute and an HR consultant misses the data. We see the whole picture, so you explain your business once.
In practice, that means one advisor who understands both the law and how a business really runs. You get clear answers, a plan you can act on, and someone who stays with you until the matter is closed.
Privacy
Making data protection practical. This is the heart of our practice. We act as your data protection officer, or support the one you have, so you meet the GDPR in Malta, Spain and wherever else you operate in Europe, without slowing the business down.
Data protection officer as a service
A senior DPO on call for a fixed monthly fee, without a full-time hire. Named in your records, known to your team and there when a question lands.
Data protection health check
Where you stand today, in a short written report and a plan in order of priority. A fixed scope and fee, and a clear place to start.
Contracts, policies and impact assessments
Data processing terms reviewed with suppliers and clients, policies written for the way you actually work, and DPIAs before a new product or system goes live.
Requests, breaches and regulators
Access and erasure requests answered within the one-month deadline, including requests from employees in the middle of a dispute. Breaches, complaints and enquiries handled calmly with the supervisory authority concerned.
Data protection training
Practical sessions for your teams, managers and board, built around your own processes and the situations they actually encounter.
Board oversight
Clear briefings that help your board understand its data protection risks and show that it is overseeing them.
People
We help you tackle the people issues most businesses put off. The result is a business that runs more smoothly and a team that is happier for it. Growing companies rarely have a senior HR specialist in the room. We give you one when it matters, to find a solution that works before a difficult situation becomes a dispute.
Fractional HR leadership
A senior head of people for a few days a month, leading the function until you are ready for a full-time hire.
Workplace issues
Grievances, conflicts and sensitive complaints handled fairly and discreetly, before they escalate.
Pay transparency
Compliance with the EU Pay Transparency Directive: pay structures reviewed, gaps understood and explained, and clear answers ready when employees ask about pay.
Performance improvement plans
Designed, set up and run alongside your managers, from the first conversation to the outcome.
Monitoring and HR records
Monitoring, HR systems and record keeping set up lawfully, and explained clearly to your people.
Organisational reviews
Structure, roles and reporting lines looked at with fresh eyes, and a clear set of changes you can actually make.
Boards and shareholders
Independent support on people decisions at board level, and with preparing for shareholders' meetings.
When to call us
It usually starts with one sentence.
We think we have had a data breach.The first 72 hours matter. We assess it with you, decide whether to notify and deal with the regulator.
A client's due diligence asks who our DPO is.We can be your data protection officer, named and on call, for a fixed monthly fee.
A manager wants to let someone go.We check where you stand and, where it fits, run a fair performance plan first.
An employee in a dispute has asked for every email that mentions them.Two disciplines, one answer. We handle the request and the dispute together, so neither makes the other worse.
Who we are
Yasmine Aquilina
Founder and advisor
I founded Ilma Advisory after more than ten years in data protection, first in private legal practice and then in senior in-house roles. Most recently I led both the people and privacy functions of an international group, which showed me how closely the two are linked and how much a business gains when they work together.
I trained as a lawyer in Malta, where my career began. Since then I have been a Data Protection Officer, built and led privacy functions across several countries, and advised leadership teams and boards on privacy, risk and people. I know the work from both sides: as the advisor, and as the person inside the business who has to make the advice work. Today I am based in Madrid, Spain, and work with companies across Europe.
Ilma is how I bring that experience to growing companies: the same standard, without the weight of a large firm. You work with me directly, from the first call. I work in English, Maltese and Spanish.
Qualifications
- Doctor of Laws (LL.D.), University of Malta
- Bachelor of Laws with European Studies, University of Malta
- Diplomas of Notary Public and Legal Procurator, University of Malta
- Certified Information Privacy Manager (CIPM), International Association of Privacy Professionals
- Chief Human Resources Officer Programme, University of Cambridge Judge Business School
Senior from the first call
You speak to the person who does the work. No handovers, and no learning on your time.
Quick to answer
Problems do not wait. We reply fast, give feedback early and keep matters moving until they are closed.
Shaped to you, never templated
The advice fits your size, your sector and the markets you work in.
Ilma is the Maltese word for water. Clear, adaptable and always finding a way through: that is how we advise.
How we work
Listen first. Be clear. Stay until it is resolved.
We listen
A first conversation, free of charge, to understand the situation and what you need from it.
We tell you where you stand
Our recommendation first, the reasoning after, and a fixed scope and fee before any work begins.
We see it through
We draft, negotiate, reply and follow up, and stay with the matter until it is closed.
One matter
A specific challenge
A data subject request, a contract, a restructuring, a board paper. Scoped, priced and delivered.
Ongoing
An advisor at your side
An outsourced DPO or a monthly retainer, with someone who already knows your business, your people and your regulators.
FAQ
Questions we are often asked.
Do we need a data protection officer?
Under the GDPR, you must appoint one if your core activities involve large-scale monitoring of people, or large-scale use of sensitive data such as health information. Public bodies must appoint one too. Many growing companies are not strictly required to, but could still benefit from a named, senior person who owns data protection. We can tell you which applies to you in one call.
What does an outsourced DPO actually do?
Everything an in-house DPO would: advising on new projects and contracts, keeping your records in order, handling requests and breaches, training your people and being your contact point for the regulator. You get senior expertise for a fixed monthly fee, without a full-time hire.
How much does it cost?
Every engagement has a fixed scope and fee agreed before any work begins. The DPO service is a fixed monthly fee, and the health check is a one-off fixed fee.
What is the Pay Transparency Directive, and does it affect us?
It is an EU law on equal pay. It gives candidates the right to know the pay range before an interview, and gives employees the right to know how pay is set, as well as the right to ask how their pay compares. Larger employers must also report their gender pay gap. Most of it applies to every employer, whatever its size. The details depend on how Malta, Spain and other countries put it into national law, and we help you work out what applies and get ready.
An employee has asked for all their data. What do we do?
Do not ignore it. You usually have one month to respond, and requests made during a dispute need particular care with other people's information. We can take the request off your hands or guide your team through it.
We think we have had a data breach. What now?
Act quickly. If the breach is a risk to people, the supervisory authority must usually be told within 72 hours, and sometimes the people affected must be told too. Get in touch straight away, and we will help you assess it, contain it and decide who needs to be told.
Do you only work in Malta and Spain?
No. We work with companies across Europe, in English, Maltese and Spanish.
What happens on the first call?
It's a 30-minute call, with no obligation. We listen to what is on your desk, tell you honestly where you stand, and suggest a next step if one is needed.
Contact
What's come across your desk?
A few lines are enough. We reply within one working day, and the first conversation is free.
info@ilmaadvisory.com