GDPR compliance you can prove to a regulator.
We map your personal data, set a lawful basis for every use, and build the records, DPIAs and breach playbook a supervisory authority expects to see.
- New to the EU market:
- a data map, a gap list and a roadmap to accountability.
- Already compliant on paper:
- evidence that the policies match what your systems really do.
- Every processing activity mapped to a lawful basis
- Article 30 records kept from real data flows
- A breach playbook built around the 72-hour clock
- Mapped to ISO 27001, SOC 2 and India's DPDP Act
What is the GDPR, and who does it apply to?
The General Data Protection Regulation is the EU law on personal data. It applies to organizations in the EU, and to those anywhere that offer goods or services to people in the EU or monitor their behaviour. It's built on seven principles, and its centre of gravity is accountability: being able to prove compliance.
Your processing
- Customer and user data
- Employee data
- Marketing and analytics
- Vendors and sub-processors
- Data leaving the EU
- Special category data
The Regulation
- Seven principles (Art. 5)
- Six lawful bases (Art. 6)
- Eight individual rights
- Records of processing
- DPIAs for high risk
- 72-hour breach notice
GDPR
Accountability you can evidence
There's no GDPR certificate. Compliance is a programme you run and document: records, assessments, contracts and decisions a supervisory authority can inspect.
Fines reach €20 million or 4% of global annual turnover, whichever is higher.
Five duties that shape every programme
Lawful basis
One of six bases for every purpose, chosen before you start.
Individual rights
Access, erasure, portability and more, answered within one month.
DPIAs
A data protection impact assessment before high-risk processing.
Breach notice
To the authority within 72 hours of becoming aware.
Transfers
Data leaves the EU only through adequacy, SCCs or BCRs.
Where GDPR bites hardest
- SaaS & cloud
- E-commerce
- Health & wellness
- Fintech
- HR & recruiting
- Marketing & adtech
The trigger is often a customer's DPA or procurement review, a data subject request nobody can answer, or plans to sell into Europe. One EU user is enough to bring you in scope.
Read the GDPR principles and lawful bases, explained one by oneWho needs to comply with the GDPR?
Any controller or processor handling personal data of people in the EU, wherever it's based. Your duties depend on your role for each processing activity, and you can hold both.
01 · The people
Data subjects
- Customers and users
- Employees and candidates
- Website visitors
- Marketing contacts
Hold rights over their data, and get a notice at collection.
02 · Your organization
Controller or processor
- Decides purposes (controller)
- Processes for customers (processor)
- Often both, per activity
- Keeps Article 30 records
Accountable to the supervisory authority for compliance.
03 · Your vendors
Processors & sub-processors
- Cloud hosting
- Email and CRM
- Analytics and support tools
Bound by an Article 28 DPA, with transfer safeguards where needed.
If you have EU users, EU employees, or a customer has sent you a data processing agreement, the GDPR already applies to you.
Your vendors that touch personal data are processors or sub-processors. Each needs an Article 28 agreement, and data they move outside the EU needs a transfer safeguard.
How a GDPR compliance program works
Six phases, each with a named output and a clear ask of your team. The GDPR gap assessment covers the first two. The GDPR program runs all six.
- Map
Data mapping & records
We trace where personal data enters, flows, is stored and leaves, across systems and vendors, and turn it into your Article 30 records.
- Data inventory
- Data flows
- Article 30 records
- Gap assessment
- You get
- A data map, Article 30 records and a ranked gap list.
- You provide
- System owners, your vendor list, and time for data-flow walkthroughs.
- Basis
Lawful basis & notices
We set a lawful basis for each purpose, run legitimate interests assessments where needed, and rewrite privacy notices and consent flows to match reality.
- Lawful bases
- LIAs
- Privacy notices
- Consent and cookies
- You get
- A lawful-basis register, LIAs and updated notices.
- You provide
- Product and marketing leads to confirm purposes.
- Rights
Data subject rights
We build a DSAR workflow: intake, identity checks, search across systems and processors, redaction, and answers inside one month.
- DSAR workflow
- Identity checks
- Search runbook
- Request log
- You get
- A working rights process and response templates.
- You provide
- Support and engineering owners for each data store.
- Assess
DPIAs & vendor risk
We screen processing for high risk, run the DPIAs that are needed, and review your processors: Article 28 agreements and their security.
- DPIA screening
- DPIAs
- Processor DPAs
- Vendor reviews
- You get
- Completed DPIAs, a screening step, and reviewed DPAs.
- You provide
- Owners of high-risk features, and access to vendor contracts.
- Breach
Security & breach readiness
We align security to Article 32, write the breach playbook around the 72-hour clock, and rehearse it with the people who'll run it.
- Article 32 security
- Breach playbook
- Notice templates
- Tabletop drill
- You get
- A tested breach playbook and ready notice templates.
- You provide
- Security, legal and leadership time for the drill.
- Transfer
Transfers & ongoing privacy
We inventory transfers outside the EU, put SCCs and transfer assessments in place, train staff, and set the review cycle that keeps it all current.
- Transfer inventory
- SCCs and TIAs
- Training
- Review cycle
- You get
- A transfer register and an annual privacy calendar.
- You provide
- A named privacy owner or DPO.
No one-size timeline: it depends on how much personal data you process, how many systems and vendors touch it, and how much is already documented. You get a firm timeline in writing before work starts.
What you receive
Everything the program produces lands in one accountability file. Each item is paired with the question a supervisory authority or a customer's privacy team asks about it.
Each gap comes with the specific fix and the owner who'll run it. We verify each fix and update the records, so the evidence exists before anyone asks for it.
There's no official GDPR certificate. Compliance is judged by supervisory authorities and your customers' privacy teams. We help you build the evidence they ask for.
01, Map phase: Data map & Article 30 records
Purposes, data categories, recipients, transfers and retention for each activity.
02, Basis phase: Lawful-basis register
One basis per purpose, with LIAs where you rely on legitimate interests.
03, Basis phase: Privacy notices
Clear notices for customers, staff and visitors, checked against the data map.
04, Rights phase: DSAR workflow & log
Intake, identity checks, search runbook and a request log.
05, Assess phase: DPIAs
A screening step and full DPIAs for high-risk processing.
06, Assess phase: Processor agreements
Reviewed DPAs and a vendor register with security evidence.
07, Breach phase: Breach playbook
Roles, decision path, notice templates and a breach register.
08, Transfer phase: Transfer register
Each transfer with its SCCs, adequacy or BCRs and its assessment.
09, Transfer phase: Training & review calendar
Staff training records and a yearly review cycle.
Illustrative example, not client data
What one Article 30 record looks like
- Activity
- Customer support tickets
- Purpose
- Resolving customer issues
- Lawful basis
- Contract (Art. 6(1)(b))
- Data
- Name, email, account ID, ticket content
- Recipients
- Helpdesk vendor (processor, SCCs)
- Retention
- Two years after ticket closure
Four common GDPR misconceptions
Each one is common, reasonable, and the reason privacy reviews stall.
Assumption 01
Assumption: We're not in the EU, so GDPR doesn't apply.
What the GDPR actually means
It applies to anyone offering goods or services to people in the EU or monitoring their behaviour, wherever the company sits.
Assumption 02
Assumption: We need consent for everything.
What the GDPR actually means
Consent is one of six lawful bases. Most core processing runs on contract, legal obligation or legitimate interests.
Assumption 03
Assumption: A privacy policy page makes us compliant.
What the GDPR actually means
The notice is one duty. Accountability means records, lawful bases, rights handling, DPIAs, DPAs and a breach playbook you can show.
Assumption 04
Assumption: Our cloud provider handles GDPR for us.
What the GDPR actually means
The provider is your processor. As controller you still decide purposes, set the lawful basis, answer requests and notify breaches.
Heard one of these from your team? A GDPR gap assessment shows where you really stand.
Get a GDPR gap assessmentWhat you can hold us to.
We don't publish client logos or case studies; we keep our clients' data practices private. These are the commitments we make instead.
Our commitments
Experienced practitioners lead
Every engagement is led by experienced practitioners.
Peer review
Every deliverable is peer-reviewed before it reaches you.
Written scope and change control
You know what is covered, and what happens if scope changes, before work starts.
Processes your team can run
Workflows built for how you operate, that keep working after we leave.
Working with Auditify Security on GDPR compliance was a great decision. Their team helped us implement the right processes, ensure data protection, and keep us in line with all GDPR requirements.
Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.
Ask for a referenceGDPR questions buyers ask
Does GDPR apply if we're not in the EU?
Yes, if you serve or monitor people in the EU.
The GDPR has extraterritorial reach: offering goods or services to people in the EU, or monitoring their behaviour, brings you in scope wherever you're based.
The GDPR, explained one duty at a time.
Every GDPR guide we publish: the foundations, what you owe individuals, the assessments and incidents that test you, and how GDPR sits beside ISO 27001 and India's DPDP Act.
Foundations03
Individuals & risk03
Know where your GDPR gaps are, before a regulator finds them.
Send the basics
Your product, where your users are, roughly how many people, and the vendors that touch personal data.
We scope the work
We respond within 24 hours, then agree the scope with you in writing.
Your GDPR gap assessment
You get a data map, a ranked gap list and a roadmap to accountability.
- New to the EU market:
- a data map, a gap list and a roadmap to accountability.
- Already compliant on paper:
- evidence that the policies match what your systems really do.
We build and evidence your programme. We don't provide legal advice; your counsel signs off on legal positions.