Comprehensive GDPR Review and Advisory

Authority Inspection Revealed 15 Violations - €55K Fine

E-commerce company had no processing activities register, didn’t inform customers about rights, transferred data to USA without proper safeguards. Authority conducted inspection after customer complaint. Found 15 GDPR violations. Fine: €55K + order to remediate within 30 days + follow-up inspection.

Without GDPR compliance:

• Risk fines up to €20 million or 4% of annual turnover
• Lose customer trust after data breaches
• Can’t work with contractors requiring compliance
• Class action lawsuits from affected individuals

From Audit to Full GDPR Compliance

We don’t leave you with a report full of legal paragraphs. We explain GDPR in plain language, deliver ready documentation templates tailored to your industry and help implement practical procedures that work.

What you get:

• Personal data processing audit in organization
• Inventory of all data sets and processing operations
• Gap analysis against GDPR requirements and risk identification
• Legal basis assessment (contract, consent, legitimate interest)
• Processing agreement review with vendors (hosting, CRM, marketing)
• Technical and organizational measures assessment (encryption, backup, access control)
• Remediation plan - prioritized actions with deadlines
• Ready templates: privacy policy, information clauses, consents, registers
• Procedures: breaches, data subject rights, international transfers
• Training for employees and management (GDPR awareness)
• Support in preparing for authority inspections

Who Is It For?

This service is for you if:

• You process personal data of customers, employees, contractors
• You don’t have processing activities register (required for >250 employees)
• You haven’t updated GDPR documentation since 2018
• You’re expecting authority inspection or received data subject request
• You want certainty of meeting requirements and avoiding fines

Key GDPR Areas

1. Legal Basis for Processing

Every processing must have basis from Art. 6 GDPR:

• Contract - data necessary for contract performance (e.g., goods delivery)
• Consent - voluntary, specific, informed (weakest basis)
• Legal obligation - required by law (e.g., accounting)
• Legitimate interest - justified controller interest (e.g., marketing)
• Vital interest - protecting life or health
• Public task - exercising public authority

Most common mistake: Everything on consent (should be: contract + legitimate interest)

2. Information Obligation

You must inform individuals about processing BEFORE collecting data:

• Controller and DPO contact
• Purposes and legal bases
• Data recipients (who receives data)
• Retention period
• Rights (access, rectification, erasure, restriction, objection, portability)
• Right to complain to authority
• Whether providing data is mandatory

Where: Information clause at forms, privacy policy

3. Processing Activities Register

Required for organizations >250 employees OR processing sensitive data:

• Controller and DPO name and contact
• Processing purposes
• Categories of individuals and data
• Recipient categories (who you share with)
• International transfers
• Deletion timelines
• Security measures

Format: Can be Excel, doesn’t need to be complicated

4. Data Processing Agreements

Required with every entity processing data on your behalf:

• Hosting / cloud providers (AWS, Azure, etc.)
• CRM / marketing automation (HubSpot, Mailchimp, Salesforce)
• Accounting office
• Marketing agencies with data access
• Call center / customer service outsourcing

Requirements: Art. 28 GDPR - detailed security provisions

5. Data Subject Rights

You must enable rights exercise within 1 month:

• Right of access - data copy (free for first request)
• Right to rectification - correcting inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restriction - processing suspension
• Right to data portability - receiving data in machine-readable format
• Right to object - to marketing and profiling

Procedure: How do you verify identity? Who responds? What timeline?

6. Breach Notification

Data breach = security incident affecting personal data:

• To authority: 72 hours from detection (if high risk)
• To individuals: Without undue delay (if high risk to rights)
• Documentation: Register of all breaches (even unreported)

Examples: Ransomware, database leak, lost laptop, sending to wrong recipient

7. DPIA - Data Protection Impact Assessment

Required before implementing high-risk systems/processes:

• Systematic profiling and automated decisions
• Large scale sensitive data processing
• Systematic monitoring (surveillance, CCTV)
• New technologies (AI, biometrics)

Process: Description, necessity, proportionality, risk assessment, safeguards

Common GDPR Mistakes

Mistake #1: Marketing Without Legal Basis

“Newsletter consent” in pre-checked checkbox at registration = INVALID Correct: Separate, voluntary checkbox with specific information

Mistake #2: Missing Processing Agreements

You use Google Analytics, Mailchimp, hosting - no processing agreements Risk: Illegal US transfer, no data control

Mistake #3: Storing “Forever”

2010 customer data still in system despite no activity Correct: Retention periods and automatic deletion

Mistake #4: No Breach Procedure

Data breach - company doesn’t know what to do, doesn’t report to authority in 72h Risk: Double fines (for breach + failure to report)

Mistake #5: US Transfers

Using Google/Meta/AWS without proper SCC safeguards Correct: Standard Contractual Clauses + Transfer Impact Assessment

Related Glossary Terms

Learn more about key concepts related to this service:

• AWS
• CIS (Center for Internet Security)
• GDPR (General Data Protection Regulation)
• ICS
• OT (Operational Technology)
• SCA
• SSE
• Tor