Core service · Privacy & AI · EU General Data Protection Regulation
Issued by
European Union
Typical timeline
8-12 weeks
Assessed by
Gap assessment & audit
Validity
Ongoing obligation
Overview
Who needs GDPR?
- 01Any company processing personal data of people in the EU
- 02SaaS processors serving European customers
- 03Companies transferring data outside the EU
What it proves
That you collect, use and transfer the personal data of people in the EU lawfully, and can show it.
Asked for by
European customers and their data protection officers, and EU regulators.
Requirements
What the auditor looks for.
- 01Lawful basis & transparencyDocumented basis for processing and clear privacy notices.
- 02Records & DPIAsRecords of processing activities and impact assessments for high-risk processing.
- 03Data subject rightsAccess, erasure, portability and objection handled on time.
- 04Processors & contractsData processing agreements with every processor, and due diligence on their sub-processors.
- 05International transfersStandard Contractual Clauses or another valid mechanism, with a transfer assessment, for data leaving the EEA.
- 06Breach notificationSupervisory authority notified within 72 hours where required.
Our approach
How we get you GDPR-ready.
What you get
What you walk away with.
- 01Data map & record of processing
- 02Privacy notice review
- 03DPA templates
- 04Transfer assessment
- 05DPIA template
- 06Rights & breach procedures
FAQ
Questions, answered.
There is no single, widely used GDPR certificate. Companies show compliance through records, contracts and procedures, often backed by ISO 27701 or SOC 2 privacy criteria. We prepare that evidence and, where you want a certification, coordinate the auditors.
Yes, if you offer goods or services to people in the EU or monitor their behavior.
Only in certain cases, such as large-scale monitoring of people or large-scale processing of sensitive data. We'll tell you during the gap assessment whether you do.
Typical timeline: 8-12 weeks, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. GDPR shares substantial control overlap with ISO 27701 and CCPA, so we build one control set and map evidence across all of them.
Next framework
CCPA
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.