GDPR Compliance and European Data Protection

Flow chart of the GDPR engagement, 6 phases in order, each one selectable. Phase 1, Data Mapping and Lawful Basis. We map your processing activities and confirm a lawful basis for each one. This is the backbone of GDPR compliance. Activities: Inventory processing activities across the business; Assign a lawful basis to each activity; Document legitimate interest assessments where used; Flag special category data and its conditions. Hands over Processing Inventory and Lawful Basis Register. Phase 2, Gap Assessment. We measure your practices against the GDPR articles and give you a prioritised action plan. Activities: Assess practices against the accountability articles; Review notices, consent, and rights handling; Check security measures against article 32; Rank gaps by fine exposure and effort. Hands over GDPR Gap Assessment and Action Plan. Phase 3, Rights and Consent Processes. We build workflows for data subject rights and, where needed, consent that meets the standard. Activities: Build workflows for access, erasure, and portability requests; Set the one-month response clock and tracking; Redesign consent capture where consent is the basis; Train frontline teams to recognise requests. Hands over Data Subject Rights Workflow. Phase 4, Records and Impact Assessments. We help you maintain records of processing and run data protection impact assessments for high-risk work. Activities: Build article 30 records of processing; Set DPIA screening criteria for new projects; Run DPIAs for existing high-risk processing; Embed the records into change management. Hands over Records of Processing and DPIA Templates. Phase 5, Transfers and Breach Readiness. We review international transfers and set up breach reporting within the 72-hour requirement. Activities: Map international transfers and their safeguards; Put Standard Contractual Clauses in place where needed; Run transfer impact assessments for key routes; Write and test the 72-hour breach procedure. Hands over Transfer Register and Breach Response Procedure. Phase 6, Readiness Review. We run a final review so you can demonstrate accountability to a customer or a supervisory authority. Activities: Test the rights workflow with sample requests; Verify remediation of gap assessment findings; Compile the accountability evidence pack; Brief leadership on residual risk. Hands over GDPR Readiness Report. Each phase begins from the artefact the phase before it produced.