Website Compliance Audit

What we do

We go through your website top to bottom. Cookies, consent banners, privacy notice, third-party scripts, trackers, hosting. If something is unlawful or missing, we flag it and tell you exactly how to fix it.

Who needs this

Pretty much anyone with a website that collects personal data, which at this point is almost everyone. Cookie banners that don't actually work are a frequent source of complaints to regulators.

GDPR Audit

What we do

We look at everything your company does with personal data. Interviews with your people, review of your forms, contracts, procedures, systems. You get a written report with what's wrong, what's fine, and what to do about it.

Who needs this

If you've never had a proper review done, or if something has changed significantly in how your company operates, this is usually where you start before doing anything else.

GDPR Implementation

What we do

We build the compliance programme for you. Everything written for your actual situation, not copy-pasted from a template.

Who needs this

Companies that have done an audit (or already know what's missing) and now need to close the gaps. This is the doing part.

Documents we draft for you

• Website Privacy Notice
• Employee Privacy Notice
• Job Candidate Privacy Notice
• Cookie Policy
• Consent Forms
• Data Protection Agreements with Suppliers
• Contract Clauses for Data Sent Outside the EU
• Record of Data Use
• Data Breach Response Procedure
• Procedure for Requests from Individuals
• Data Retention Policy
• Internal Data Protection Policy

Data Protection Officer as a Service

What we do

We act as your official Data Protection Officer, named in your documents and notified to the data protection authority. We cover what the role requires: monitoring compliance, advising you, helping you handle requests from individuals and incidents, acting as your contact with the authority, and keeping you updated when the law changes.

Who needs this

Some companies are legally required to have a Data Protection Officer. Many others appoint one voluntarily because their clients expect it. Either way, hiring one in-house is expensive. This is the practical alternative.

EU AI Act Audit

What we do

We map every AI system your company uses or has built, sort each one by risk level under the AI Act (banned, high, limited, or minimal), and tell you exactly which obligations apply to you and by when.

Who needs this

You don't need to build AI to be caught by this regulation. If you use AI tools for hiring, customer profiling, or monitoring, some rules may already apply to you, and others are on a fixed timeline.

Data Protection Impact Assessment (DPIA)

What we do

We assess the privacy risks of a specific activity before it goes live. CCTV systems, biometric access, GPS tracking, large-scale profiling, new software that handles sensitive data. We document the risks, the safeguards, and whether what you're doing is actually legal.

Who needs this

If your company is about to introduce something that uses personal data in a way that could put people at high risk, GDPR requires a DPIA before you start. For most other new projects, it is still a very good idea.

NIS2 Compliance

What we do

We assess whether NIS2 applies to you, find the gaps in your current security, and help you build what the law requires: risk management, incident reporting procedures, supplier security, and the mandatory training for senior management.

Who needs this

Mainly companies with 50 or more employees, or more than €10M in annual turnover, in sectors like health, digital infrastructure, food, manufacturing, or public administration. Some smaller companies are covered too. NIS2 also means senior managers can be held personally liable for failures, which tends to focus minds.

Data Breach Response

What we do

When something goes wrong, we step in fast. We assess the breach, prepare and file the notice to the data protection authority with you within the 72-hour legal deadline, help you inform the people affected, and document everything the regulator will ask for. On retainer, we also run an annual breach simulation so your team knows what to do before it happens.

Who needs this

Any company that handles personal data, which is nearly all of them. Regulators look closely at how a breach was handled when deciding on fines. Getting the response right matters as much as preventing the incident in the first place.