GDPR AND PRIVACY
Data processing in order, and kept that way
Records, DPIAs, privacy notices, data-subject rights and transfers: GDPR compliance built to withstand scrutiny, not to fill a drawer.
GDPR compliance is not a one-off task but a state to be maintained. Every new processing activity, vendor or tool shifts the balance, and documentation loses its value the moment it stops matching reality. Fines for breaches reach up to 2% or 4% of worldwide annual turnover depending on the provision infringed, but the greater cost is almost always the inability to demonstrate your choices when it matters. I step in to put the organisation's privacy in order and then to keep it aligned: from records of processing to impact assessments, from privacy notices to handling data-subject requests, through to transfers outside the Union. Every choice is anchored to a legal basis and to evidence, so that the accountability principle is met in practice.
WHAT IT INCLUDES
What it includes
Record of processing activities
Building and maintaining the Article 30 record, aligned with the organisation's actual processing.
Impact assessments (DPIAs)
Analysis of high-risk processing, with mitigation measures and, where needed, prior consultation of the authority.
Privacy notices and legal bases
Drafting of Article 13 and 14 notices and mapping of the legal bases for each processing activity.
Data-subject rights
Procedures for access, rectification, erasure and objection, with response times and methods that meet the law.
Dealings with vendors and processors
Article 28 processor appointments and verification of contractual safeguards along the processing chain.
Transfers outside the Union
Assessment of the bases for non-EU transfers, standard contractual clauses and analysis of the destination country.
Data breach management
An incident response procedure and assessment of notification to the authority and data subjects within the legal deadlines.
WHO IT IS FOR
Who it is for
The service is aimed at companies that process the personal data of clients, users or employees and want solid, documented compliance, at those preparing for an audit or due diligence, and at those who have received a data-subject request or a complaint and must respond correctly. It is useful both for an initial assessment and for the ongoing maintenance of an existing framework.
FREQUENTLY ASKED
Frequently asked questions
What is a DPIA (data protection impact assessment, Article 35), and when is it mandatory?
A DPIA is the data protection impact assessment required by Article 35 where processing is likely to result in a high risk to the rights of data subjects, for example profiling, systematic monitoring or large-scale processing of special data. It serves to identify the risks and the measures to mitigate them before processing begins. If the risk remains high despite the measures, the authority must be consulted.
How do you make a transfer of data outside the European Union compliant?
A transfer to a third country is lawful if the country benefits from an adequacy decision of the European Commission or, failing that, if adequate safeguards such as standard contractual clauses are in place. Alongside these sits the Transfer Impact Assessment, which checks whether those safeguards are actually effective in the destination country. It is a step that must be documented, not taken for granted.
Do you need a lawyer for the GDPR, or is a privacy consultant enough?
Many tasks can be handled by a consultant, but where choices have legal consequences, such as defining legal bases, contracts with vendors, or handling a complaint or an inquiry by the authority, the responsibility is a legal one and a lawyer is the better fit. The value lies in keeping operational compliance and the defensibility of decisions together before an authority.