GDPR Readiness & Privacy Compliance Advisory

What we assess

We map processing purposes, personal data categories, recipients, retention, and cross-border flows. The review connects operational privacy controls with legal bases and transparency decisions, records of processing, individual rights, impact assessments, processor management, and security. Legal interpretation and transfer mechanisms should be validated with counsel.

Evidence to prepare

• Processing inventories, role mapping, privacy notices, and retention decisions.
• Data protection impact assessments, vendor agreements, and transfer documentation.
• Rights-request records, security safeguards, incident escalation, and workforce training.

Keep design evidence separate from operating evidence. An approved procedure shows how a control is designed; dated records show whether it ran consistently over the review period. Evidence should identify its source, owner, scope, and collection date.

What you receive

• Privacy readiness findings with processing-specific remediation priorities.
• Operational workflow recommendations for requests, assessments, and vendor review.
• Evidence and ownership map integrating privacy with your security program.

Common questions

Does ISO 27001 certification make us GDPR compliant?

Security certification can support safeguards, but GDPR also addresses processing lawfulness, transparency, rights, and other obligations. Those responsibilities need a separate applicability and operational review.

What determines the engagement timeline and cost?

The system boundary, number of entities and locations, existing control maturity, evidence availability, and assessment pathway determine the effort. Share your customer requirements and target milestone so we can define a realistic scope before proposing a schedule.