GDPR Compliance Consulting
For any organisation processing personal data of EU residents — records of processing, DPIAs, data-subject rights, 72-hour breach notification, and DPO support.
The GDPR is the EU regulation governing the processing of personal data, enforceable since May 2018 with fines up to €20 million or 4% of global turnover. Passeca builds your Record of Processing Activities, conducts DPIAs, stands up the 72-hour breach-notification process, supports data-subject rights, and provides or backs your DPO — securing processing on an ISO 27001 baseline.
What is the GDPR?
The General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) is the EU regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. It has applied in all EU member states since 25 May 2018 and is directly enforceable — it does not require national transposition, though each member state has a national supervisory authority and accompanying national law.
The GDPR is built on a set of principles — lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. It grants individuals a set of rights (access, rectification, erasure, restriction, portability, objection), and it places specific obligations on controllers and processors, including maintaining records of processing, reporting breaches within 72 hours, conducting DPIAs for high-risk processing, and designating a Data Protection Officer where required.
Who needs GDPR compliance?
- You process personal data of EU residents. This applies whether or not your organisation is based in the EU (extraterritorial scope, Article 3).
- You offer goods or services to individuals in the EU. Even free services are in scope if they target EU individuals.
- You monitor behaviour of individuals in the EU. Tracking, profiling and cookies fall within scope.
- You are a controller or a processor. Both have obligations; processors have direct duties under the GDPR, not only via the controller contract.
What does the GDPR actually require?
The GDPR's requirements flow from its principles and rights, operationalised through specific articles. The bulk of a compliance programme turns these articles into processes and evidence.
- Lawful basis and transparency (Art. 6, 13–14) — identify a legal basis for every processing activity and inform individuals in clear privacy notices.
- Records of processing activities (Art. 30) — maintain a living inventory of all processing, purposes, recipients, transfers and retention.
- Data-subject rights (Art. 15–22) — operational processes to handle access, rectification, erasure, restriction, portability and objection requests within one month.
- Security of processing (Art. 32) — appropriate technical and organisational measures, typically delivered on an ISO 27001 baseline.
- Personal data breach notification (Art. 33–34) — notify the authority within 72 hours and, for high-risk breaches, affected individuals without undue delay.
- DPIAs (Art. 35) — assess high-risk processing before it begins.
- Data Protection Officer (Art. 37–39) — designate a DPO where required and resource the role.
- International transfers (Art. 44–49) — use adequacy, SCCs or other transfer mechanisms for data leaving the EEA.
Accountability (Article 5(2)) runs through all of this: you must not only comply but be able to demonstrate compliance on demand to a supervisory authority.
How Passeca helps you achieve GDPR compliance
- 01
Processing inventory & RoPA
We build your Record of Processing Activities (Article 30) — a complete inventory of what personal data you process, why, where, and on what legal basis. The RoPA is the backbone of every other GDPR obligation.
- 02
Gap analysis
We assess your current practice against the GDPR principles and data-subject rights — lawful basis, transparency, retention, security of processing, international transfers — and rank the gaps by regulatory risk.
- 03
DPIAs & risk treatment
We conduct Data Protection Impact Assessments (Article 35) for high-risk processing, and design the technical and organisational measures (Article 32) that treat the risks the DPIAs surface.
- 04
Implementation
We implement the missing measures — privacy notices, consent management, data-subject-request process, breach-notification process, vendor data-protection terms — and embed evidence capture in Hyperproof.
- 05
DPO support & ongoing assurance
We provide or support your Data Protection Officer, run tabletop exercises on the 72-hour breach-notification process, and keep the RoPA and DPIAs current so you can demonstrate compliance to a supervisory authority.
What you get from the engagement
How long does GDPR compliance take?
| Maturity | Typical duration | What drives it |
|---|---|---|
| No RoPA, no baseline | 4–8 months | Building the processing inventory from scratch |
| RoPA exists, gaps to close | 2–4 months | Closing rights, breach and transfer obligations |
| DPO support only | Ongoing | Monthly retainer for ongoing assurance |
The processing inventory (RoPA) is almost always the longest pole. Organisations with mature IT asset and data-flow records compress this significantly. DPO support is then an ongoing retainer.
How much does GDPR compliance cost?
GDPR is a regulation, not a certificate, so there is no certification-body fee. Cost is consulting to build the RoPA, close the gaps, conduct DPIAs, and provide ongoing DPO support — with technology (consent management, data-discovery) where needed.
| Maturity | Consulting (Passeca) |
|---|---|
| No RoPA, no baseline | Price on request |
| RoPA exists, gaps to close | Price on request |
| Ongoing external DPO | Price on request |
Doing more than one framework?
| GDPR | ISO 27001 | HIPAA | |
|---|---|---|---|
| Lawful basis & transparency | Implicit | Notice | |
| Security of processing (Art. 32) | Primary | Security Rule | |
| Records of processing (RoPA) | Asset mgmt | Inventory | |
| Breach notification | 72h | Incident | 60 days (HIPAA) |
| Data-subject rights | Implicit | Access | |
| Geographic scope | EU residents | Global | US PHI |
ISO 27001 is the framework most commonly used to satisfy GDPR Article 32's security requirement, so building the ISMS first covers the technical measures GDPR needs. HIPAA overlaps where US protected health information is involved. Passeca maps evidence once in Hyperproof to satisfy all applicable regimes.
GDPR compliance, answered
The questions organisations ask about meeting the GDPR.
What is the GDPR?
Who needs to comply with the GDPR?
What is the 72-hour breach-notification rule?
Do we need a Data Protection Officer (DPO)?
What are GDPR fines?
What is a Data Protection Impact Assessment (DPIA)?
How does GDPR relate to ISO 27001 and HIPAA?
How much does GDPR compliance cost?
Can you prove GDPR compliance on demand?
Book a free scoping call. We will start with your Record of Processing Activities, flag your highest-risk gaps, and give you a timeline and cost band.
Related