GDPR: Make personal data obligations work across your systems.
GDPR readiness support examines how personal data moves through your applications, teams and suppliers, and where operational practices need to change. We map data handling, assess gaps and help implement safeguards, records and response processes so your organisation can put its data protection requirements into practice.
- Discipline
- Governance, Risk & Compliance
- Engagement type
- Advisory
A privacy policy cannot show the whole picture.
A request to correct or delete information may affect a live application, exported files, analytics and service providers. Understanding those connections helps turn a stated commitment into a process the organisation can carry out and explain.
Data flows and responsibilities
Map what personal data is processed, for which purposes, where it goes and the controller or processor responsibilities involved.
Rights and retention
Review how requests reach the right people, how records are located and how retention, restriction and deletion work across the agreed environment.
Safeguards and privacy by design
Examine access, security measures and product or process choices; support risk and impact assessments where appropriate.
Suppliers, incidents and transfers
Identify dependencies, supporting records and escalation arrangements that need coordination with privacy and legal teams.
Connect the records with the people doing the work.
We review representative processing activities with the teams responsible for them, compare documented practices with actual handling and build a plan for the gaps. Technical and procedural changes can be implemented as part of the engagement. Questions about legal applicability, lawful bases or contractual interpretation are identified for the appropriate legal decision-maker.
What you receive
Processing and data-flow records
The agreed activities, systems, suppliers and responsibility boundaries.
Gap and implementation plan
Practical changes to safeguards and privacy operations, with evidence needed to demonstrate progress.
Working procedures
Agreed request handling, retention and incident workflows, with relevant assessment records and handover to owners.
Can you help an organisation outside the EU?
Yes. Location alone does not settle GDPR applicability. We can help document the processing and service relationships so the relevant legal and operational responsibilities can be established.
Do we need a DPIA for every processing activity?
No. A DPIA is required for processing likely to result in high risk to individuals. We can support screening and assessment, with the appropriate privacy or legal review of the decision.
Does ISO 27001 cover GDPR?
An ISMS can provide useful security governance and evidence. GDPR also addresses matters such as processing purposes, individual rights and controller/processor obligations; those need their own assessment.
Where do your privacy commitments become difficult to carry out?
Tell us about the product, service or data-handling process you need to review and the obligations already identified by your privacy or legal team.
Related services: Third-Party Risk Management and ISO/IEC 27001:2022.