The challenge
You collect personal data through forms, email, newsletters and customer registers — but you don't have full visibility over where all data is stored, who has access to it or whether you meet the requirements of the General Data Protection Regulation. Risks around third-country transfers (for example when using US cloud services and the CLOUD Act) are growing. Unclear legal bases, lack of Data Protection Impact Assessments (DPIA) and inadequate handling of special categories of personal data increase exposure further. Fines can reach 20 million EUR or 4% of global annual turnover.
What we do
We start by mapping what personal data you collect and where it is stored. Then we verify that each processing activity has a valid legal basis and that GDPR's core principles are being followed. We review your suppliers and sub-suppliers that handle personal data — agreements, responsibilities and potential risks. We document everything in a record of processing and assess whether a Data Protection Impact Assessment (DPIA) is required, meaning situations where the law demands an in-depth risk analysis. If you use cloud services outside the EU, we assess the transfers against current EU agreements and safeguards. We produce privacy policies, data processing agreements and procedures for incident management and handling data subject requests. You get a working framework — not a pile of documents gathering dust.
What you get
Personal data mapping and legal bases
We identify what personal data you process, verify that each processing activity has a valid legal basis and ensure GDPR's core principles are being followed.
Documentation that meets the requirements
Record of processing (Article 30), privacy policy, data processing agreements and procedures — tailored to your business. Including TIA for cloud services and third-country transfers.
Ongoing compliance
We help you keep documentation up to date, handle requests from data subjects and supervisory authorities, and follow up when your business or the regulations change.
Handling data subject rights
Your customers and employees have rights under GDPR — such as requesting access to, correcting or deleting their data. We build procedures so you can handle every request correctly and on time.
What's included
Do you have control over your data protection?
We'll do a free review and tell you where you stand — and what needs to be addressed.
Contact usFrequently asked questions
Does GDPR apply to our business?
Yes, if you process personal data about individuals in the EU — which most businesses do. We clarify exactly which requirements apply to you.
What do we get?
Complete documentation — record of processing, privacy policy, data processing agreements, procedures for incident management and data subject requests. Everything tailored to your business, ready to present to supervisory authorities.
Do we need a data protection officer?
It depends on your business. We assess whether you need one and help you find the right solution.
Can you handle our suppliers and cloud services?
Yes. We review your suppliers, assess third-country transfers and ensure agreements and responsibilities are correct throughout the chain.
How quickly can you help us?
A basic mapping typically takes 2–3 weeks. More comprehensive efforts are planned based on your situation.
What happens after the initial effort?
We follow up regularly, keep documentation current and help you handle requests from data subjects and supervisory authorities. You won't be left with a pile of documents that no one maintains.
Need help with GDPR?
Tell us about your situation and we'll give you an honest assessment. Free of charge, no obligation.