Carolina Toro Mejía – GC Powerlist
GC Powerlist Logo
Spain 2025

Information technology

Carolina Toro Mejía

General counsel | Nabiax

Download

Spain 2025

legal500.com/gc-powerlist/

Recommended Individual

Carolina Toro Mejía

General counsel | Nabiax

Team size: Two

How do you approach managing legal aspects during periods of instability or crises, and how does your legal strategy align with the broader business strategy to ensure the organisation’s resilience?

In periods of instability or crises, my approach focuses on proactive risk management always aiming to mitigate the company’s exposure to risks and assess whether those risks are assumable or acceptable for the company. This is complemented by aligning Nabiax’s strategic priorities with legal considerations and adapting legal aspects to the company’s evolving needs. I bring to the table a balanced analysis of the pros and cons of preliminary alternatives, as well as innovative solutions that integrate the company’s needs with legal compliance and risk mitigation.

In a company dedicated to the provision of a 24/7 service to its clients in its Data Centers, maintaining stakeholders’ trust is a paramount priority. Consequently, my strategy includes the following key elements to ensure organisational resilience while safeguarding stakeholder confidence as well as company’s exposure to risk: (i) anticipating and preparing for risks by creating and implementing a package of legal framework with protective clauses to limit legal liability exposure in contracts with service providers and, to the extent possible, mirroring the obligations demanded by end clients; (ii) communicating upcoming changes in law that may materially affect the company and/or require additional investment from the company to be in compliance with Law, so that senior leadership take well informed decisions; (iii) my legal strategy is fully integrated with Nabiax’s business goals and an important part is that legal processes must be agile enough to adapt to rapid changes in the needs and circumstances of the organisation. Being able to quickly shift priorities when required without leaving unattended the day-to-day business operations is a cornerstone of my department’s approach; (iv) in a period of crises or instability, I prioritise thorough risk analysis to provide leadership with actionable insights. By providing scenario-based legal strategies I enable the company to balance compliance risks with operational feasibility, ensuring Nabiax can pivot without disrupting its services.

I consider this approach ensures that Nabiax remains compliant, operationally available and strategically aligned even in uncertain times. My role as General Counsel focuses on understanding the business, anticipating stakeholders’ needs and risks and proactively addressing challenges by delivering actionable solutions, and embedding resilience into every critical business decision.

What are the main cases or transactions that you have been involved in recently?

Nabiax was established in July 2019 as part of the acquisition by our majority shareholder of a portfolio of data centers located in Latin America, the United States, and Spain. I joined Nabiax in January 2020, and one of my primary objectives was to create the company’s legal department from the ground up. While building the legal team and creating the department, by establishing initial procedures, I led and managed the negotiation of key contracts with hyperscaler clients in Spain. These agreements were instrumental in positioning Nabiax as one of the most recognised data center companies in the sector. I have consistently worked to secure value for Nabiax and its shareholders while ensuring business continuity and mitigating legal risks.

In parallel, I played a key role in Telefónica’s entry into Nabiax’s shareholding structure, where it acquired a 20% stake and contributed additional data centers to the company’s portfolio in 2021. This transaction allowed Nabiax to expand its footprint and strengthen its position in the market. I managed and coordinated the legal due diligence process in 7 jurisdictions as well as led legal negotiation of the transaction agreements which included SPA and Services Agreements for new added data centers.

During 2022–2023, I co-led the negotiation of a significant divestment of Nabiax’s operations in Latin America and the United States, valued at approx. $450 million. This transaction required navigating a complex regulatory framework, managing the due diligence process across 6 jurisdictions, securing favorable terms, and ensuring alignment with the company’s and shareholders’ objectives.

Most recently, in 2024, Aermont Capital agreed to acquire 100% of Nabiax, a transaction that underscores Nabiax’s success over the past 5 years and the trust placed in the management team. This process has been valued at around €1bn. As part of this deal, I led the due diligence process involving 6 initial bidders, advised shareholders on all legal requirements related to the company, and led the negotiation of the Management Warranty Deed.

What do you see as the major legal challenges for businesses in Spain over the next five years, and how are you preparing to address them?

As General Counsel of Nabiax, a company operating in the data center sector, I see cybersecurity and energy supply as two of the most critical legal challenges. These challenges are particularly pressing as the EU increases its regulatory focus on these sectors, demanding robust and forward-looking legal strategies to ensure compliance and mitigate risks.

The escalating risks of cyberattacks and data breaches, compounded by stricter regulatory frameworks such as the EU NIS2 Directive and cybersecurity provisions under GDPR, represent a significant challenge. Companies must not only adapt to rapidly evolving laws and standards but also manage risks effectively across their supply chains.

At Nabiax, I work closely with the operational team to align our legal frameworks with emerging cybersecurity obligations. For instance, we are in the process of incorporating cybersecurity-specific clauses in our agreements with service providers. These provisions ensure that liability is clearly allocated and that suppliers adhere to the same strict standards demanded by our end clients. These initiatives not only strengthen Nabiax’s cybersecurity resilience but also ensure that we remain compliant with EU and Spanish regulations while building trust with stakeholders.

On the other hand, the increasing energy demands of the data center sector present another critical challenge. The uncertainty surrounding the ability of energy suppliers to meet this growing demand by data center providers as well as the forthcoming possible regulatory changes to be applicable to this sector and the increases speculation in the acquisition of land plots with possible requests of energy connectivity points raises risks to those players in the industry that already have a clear expansion plan. Given the uncertainty around energy suppliers meeting growing demand, it is crucial to build robust contractual safeguards into agreements with both clients and suppliers as well as to explore on-site renewable energy options, such as solar or wind installations, to reduce temporary reliance on external energy suppliers.

These efforts align with my broader vision as General Counsel: transforming legal challenges into opportunities that drive trust, innovation, and value for the company and its stakeholders, this, as part of having successfully managed multi-jurisdictional transactions at Nabiax, I am able to focus on harmonizing compliance practices while aligning with local regulations focused on addressing legal challenges not as obstacles but as opportunities.

Related Powerlists