Privacy
Document your GDPR compliance as a defined project
Article 30 records of processing and Article 35 DPIAs delivered as defined projects with a fixed scope, so you can demonstrate GDPR accountability on request.
For DPOs, legal counsel and compliance leads facing regulatory scrutiny or internal audits, the burden of proof under Regulation (EU) 2016/679 (GDPR) lies with you. This page explains how we produce the records and assessments that provide this evidence, concluding with a privacy compliance review.
Article 30 records of processing
Article 30 requires controllers and processors to maintain records of processing activities: the purposes of processing, the categories of data subjects and personal data, and the technical and organisational security measures in place. These records must be available to the supervisory authority on request.
We build the record as a defined project with a fixed scope and end date, mapping your actual data flows rather than filling in a template.
Article 35 data protection impact assessments
Where processing is likely to result in a high risk to the rights and freedoms of natural persons, Article 35 requires a Data Protection Impact Assessment (DPIA) before processing begins. We deliver DPIAs as structured projects that identify, evaluate and mitigate risks, documenting the outcome as evidence of accountability.
Security of processing
Article 32 requires appropriate technical and organisational measures to protect personal data. This work falls under our Security umbrella. Where Article 37 requires a designated Data Protection Officer, we can act in that role.