DATA & PRIVACY
GDPR made practical
We turn GDPR into a runbook your product, marketing and legal teams can execute. Fast fixes for what blocks deals and audits: website & cookies (CMP), privacy notices, DSAR handling, vendor DPAs/SCCs and breach response. We refresh RoPA/DPIAs and deliver audit-ready documentation and evidence buyers and banks recognise. Start small, scale when needed.
How it works
We confirm your GDPR exposure (controller/processor roles, business units, high-risk processing) and define objectives, deliverables and milestones. This mirrors competitors’ first step: assess impact/readiness before anything else
Readiness assessment
Applicability & scope
We map data flows and complete/refresh the Article 30 record, aligning purpose, lawful basis (incl. LIAs) and retention. We follow proven approaches for choosing an IT-vs-process mapping route and building a structured inventory. Deliverable: updated RoPA + data map
Data inventory & RoPA
Systems/process map & lawful basis
We perform a consultant-led gap analysis across governance, risk, PbD, notices, DSARs, DPIAs, breaches and vendors. Output: a scored gap matrix with owners, deadlines and priorities—a standard competitor move to create a clear remediation roadmap.
Gap analysis & risk plan (10 days)
Governance, controls, privacy by design
We draft/upgrade policies and records (privacy, retention, DSAR, breach, vendor), update website/app notices and cookie/CMP settings, and set DPIA and DSAR workflows with SLAs. This mirrors typical “implementation support” after the audit
Remediation & enablement
Policies, notices, DPIAs, DSAR SLAs
We provide breach playbooks aligned to the 72-hour rule, risk assessment templates, notification letters (authority & data subjects), incident logs and evidence-capture steps—matching competitors’ emphasis on strict timelines and audit trails
Breach management & reporting
Procedures, templates & evidence
We classify controllers/processors, issue a DPA clause pack, and prepare SCCs and TIAs for cross-border transfers, plus sub-processor notifications and exit terms—consistent with leading consultancy offers.
Vendors & international transfers
DPAs, SCCs (Modules 2/3) & TIAs
We set dashboards and an evidence repository for continuous monitoring. If desired, we coordinate an independent GDPR validation for external proof (letter/cert-style attestation) and keep guidance ongoing—exactly how top vendors demonstrate trust externally.
