Milena Mora Arellano

Professional profile

Milena Mora Arellano is a lawyer specialized in personal data protection, passionate about new technologies and their intersection with law. Since July 2023 she has been part of HEKA Global Legal Strategy as Senior Privacy Consultant, advising a broad portfolio of clients on the design and implementation of privacy and data protection compliance models.

Her approach to privacy is rooted in the balance between the rights of data subjects and the protection of information as a strategic corporate asset, within a culture of compliance. She has developed legal tools and management frameworks for clients in sectors including retail, e-commerce, healthcare and supply chain.

Since February 2024 she also serves as Data Protection Officer (DPO) at NOVAECUADOR S.A., consolidating her track record in directly supporting companies with their obligations under Ecuador's personal data protection regulations. Her profile combines rigorous international academic training, consulting experience, and a strong vocation for AI ethics, legaltech and the Women in Data Privacy movement.

Academic background

• Master's in Personal Data Protection — Universidad Internacional de La Rioja (UNIR), Spain (Oct. 2021 – Nov. 2022)
• Attorney-at-Law — Universidad Central del Ecuador, Quito (Feb. 2015 – Mar. 2020)

Professional experience

• Senior Privacy Consultant · HEKA Global Legal Strategy · Jul. 2023 – present
  Data protection advisory, design of compliance models and development of legal tools for clients across diverse economic sectors.
• Data Protection Officer (DPO) · NOVAECUADOR S.A. · Feb. 2024 – present
  Oversight of regulatory compliance in data protection, handling of data subject requests and support in internal audits.
• Associate Attorney in Data Protection · Robalino Abogados · Dec. 2021 – Mar. 2023
  Specialized advisory in privacy and regulatory compliance for local and international companies.
• Data Protection Officer Intern · Consejería de Educación y Juventud, Spain · Mar. 2022 – Nov. 2022
  Internship at a Spanish public authority, focused on GDPR application and data subject request procedures.
• Legal Assistant · Juan Francisco Palacios (Administrative, Civil & Telecommunications Law) · Aug. 2021 – Dec. 2021
• Legal Assistant · DIGI-MED Ecuador · Jul. 2020 – Sept. 2021
• Legal Intern · SERTECPET S.A. · Mar. 2018 – Sept. 2018

Certifications and courses

• Certified Information Privacy Manager (CIPM) — IAPP (May 2025)
• International Course on Personal Data Protection — Universidad San Andrés, Argentina (Apr. 2024)
• Compliance Challenges in Artificial Intelligence and Data Protection — World Compliance Association (Oct. 2022)
• Leadership Diploma — Universidad Marconi + UNIR (Oct. 2022)
• Cybersecurity Course — Global Lynx (Jul. 2022)
• World Technology Law Conference — ITechLaw (Jul. 2021)