We map your data, close the gaps and stand up the processes, so personal data stays protected and your compliance holds up to scrutiny.
Fines reach 20 million euro or 4 percent of global turnover, breaches that put people's rights at risk must be reported within 72 hours, and eight data subject rights apply to any organisation serving EU residents.
We benchmark your current processing against GDPR and map every data flow to surface where you fall short.
Data protection impact assessments for high-risk processing, with concrete mitigation measures documented.
Article 30 records (ROPA) that document what you process, why, and on what legal basis.
Privacy policies, notices and data processing agreements drafted for your actual operations, not templates.
A tested procedure to detect, assess and report a breach inside the 72-hour window.
An outsourced Data Protection Officer function, from day-to-day advice to liaison with the regulator.
Process data on a valid legal basis and tell people plainly how you use it.
Collect data for specified, explicit purposes and don't reuse it for incompatible ones.
Hold only the data you actually need for the task at hand.
Keep personal data correct and up to date; correct or erase what isn't.
Retain data only as long as the purpose requires, then delete it.
Protect data with appropriate security against loss, misuse and unauthorised access.
Every organization that processes the personal data of people in the EU, wherever the organization is based. That includes EU companies and non-EU companies offering goods or services to EU residents.
A DPO is mandatory for public authorities, organizations whose core activity is large-scale processing of special-category data, and those carrying out large-scale systematic monitoring of individuals.
A Data Protection Impact Assessment is required before high-risk processing. It assesses the impact on people's privacy and sets out the measures to reduce that risk.
72 hours to notify the supervisory authority once you become aware of a breach that risks people's rights. Where the risk is high, the affected individuals must be told as well.