GDPR Compliance and Audit

Data protection compliance suffers from a scale problem. The guidance available is written for organisations with a legal department, and most organisations do not have one. What they have is a director who knows this matters, a privacy notice copied from somewhere in 2018, and a genuine uncertainty about whether they are exposed.

Our approach is proportionate. A fifteen-person consultancy processing employee and client contact data does not need what a healthcare provider processing special category data at scale needs, and pretending otherwise wastes money without reducing risk.

We start by establishing what personal data you actually hold, where it came from, why you have it, who you share it with, where it goes and how long you keep it. That produces your record of processing activities, which is a requirement in its own right and also the foundation for everything else. Most organisations find the exercise revealing regardless of the compliance benefit, particularly around retention and third-party sharing.

We then assess that against the data protection principles and the individual rights, and against your practical arrangements: privacy notices, lawful bases, consent mechanisms, contracts with processors, international transfers, security measures, breach procedures and retention schedules.

The output is a prioritised action plan, ordered by risk to individuals and exposure to you, not by the order the topics appear in the legislation.

This works well alongside ISO 27001, where the information security controls and the data protection obligations reinforce each other, though they are not the same thing and one does not deliver the other.

Equas is not a law firm. Where a question turns on legal interpretation, particularly around lawful basis, international transfers or a live incident, we will tell you and recommend you take professional legal advice.