Do your GDPR documents really match your day-to-day operations?

Data protection compliance often looks sound on paper, while the actual data processing, systems in use, and internal processes have long since changed.

In the assessment we review, among other things:

• the flow of personal data and the purposes of processing;
• the records of processing activities;
• privacy notices and consents;
• data processing agreements;
• processing based on legitimate interest;
• the necessary impact assessments;
• the handling of employee and customer data;
• incident response and data subject request processes.

The result is a priority list showing what's compliant, what needs improvement, and where there is a real business or regulatory risk.