GDPR Compliance Consultancy

What GDPR is usually taken with

Few organisations stop at one standard, and the second costs far less than the first — the clauses that take longest are the ones they share. Where GDPR sits next to something else, this is what carries over.

• ISO/IEC 27701 consultancy — is the certifiable management system that demonstrates this obligation.
• ISO/IEC 27001 consultancy — supplies the security of processing the regulation requires.

Certified to more than one, you hold a single management system with one set of objectives, one internal audit programme and one management review — audited in one visit. Run as separate systems they cost roughly twice as much to keep, which is the usual reason a second certificate feels harder than it was.

Personal data rules that follow the data, not the company

The General Data Protection Regulation governs processing of personal data belonging to people in the European Union and European Economic Area. It applies to controllers who decide why and how data is processed and to processors acting on their instructions. Its reach is extraterritorial: an Indian or Gulf company offering goods and services to people in Europe, or monitoring their behaviour, is caught regardless of where its servers sit. Maximum fines are set against worldwide annual turnover.

In practice it arrives through contracts. European clients require a data processing agreement, security schedules and audit rights, and their own regulators expect them to check you. Software companies, business process operations, recruitment and payroll providers, ecommerce sellers, travel and hospitality businesses and research organisations all meet it. Employee data counts too, so a European subsidiary or a handful of remote staff creates obligations that have nothing to do with the customer side of the business.

Records of processing, lawful basis and the transfer problem

Work starts with the record of processing activities, because you cannot comply with rules about data you have never listed. We map purposes, categories of data and data subjects, recipients, retention periods and international transfers, then attach a lawful basis to each purpose and test whether it actually holds. Consent gets used far more often than it should be. Legitimate interests need a balancing assessment written down, and special category data needs a separate condition of its own.

From there: privacy notices that describe reality, a procedure for handling access, rectification, erasure, portability and objection requests inside the statutory deadline, impact assessments for high risk processing, breach notification with the clock built into it, processor agreements flowing down to your own subprocessors, and transfer mechanisms such as standard contractual clauses supported by a transfer impact assessment. Security measures are documented against the regulation's security article rather than described in general terms.

Documented accountability you can put in front of a regulator

The deliverable set is the processing record, the policy and notice suite, request handling and breach procedures with their logs, assessment templates and completed assessments, agreement templates, a transfer register and training records. Where a data protection officer is required or simply useful, we help define the role and protect its independence. The regulation is not certifiable the way a management standard is, so we often pair the evidence with ISO 27701 or ISO 27001 certification issued by an independent body.

What changes is the speed of the sales cycle and the temperature of incidents. Client security and privacy reviews get answered from documents that already exist. A subject access request stops being an emergency, because somebody owns it and the search route is known. And if a breach occurs, the assessment and notification decisions follow a written method, which is the first thing a supervisory authority asks to see afterwards.