Most GDPR programmes have gaps.
Let's find yours
before the regulator does.
We help B2B SaaS companies achieve real GDPR compliance — not just documentation, but controls that survive regulatory scrutiny. GDPR certification, DPIAs, transfer frameworks, and fractional DPO across EU, UK, US, and beyond.
First half-hour is free. No obligations.
7+
Years in data privacy
20+
DPIAs & TIAs delivered
5
Jurisdictions covered
CIPP/E
IAPP certified
ISO 27701
Lead Implementor
LL.M.
Trinity College Dublin
Sound familiar?
Most companies come to us when one of these hits.
Privacy compliance isn't hard because the rules are secret — it's hard because the gap between what you think you have and what you actually need is invisible until it isn't.
Your platform processes EU personal data but you've never done a DPIA.
Customers or procurement teams are asking for compliance documentation you don't have.
You're expanding into EU or UK markets and don't know where to start.
You want GDPR Art. 42 certification as a commercial differentiator.
Your legal team handles contracts — but privacy requires a different kind of specialist.
Any of these sound like you? Book a free call — we'll tell you exactly where you stand and what needs to happen first.
How it works
From first call to compliant.
01
Discovery call
We look at what you process, where it goes, what's in place, and what's missing. You leave the call with a clear picture of your exposure — not a sales deck.
02
Gap assessment & plan
A prioritised list of what needs to be built, fixed, or documented — with honest guidance on what order matters and why.
03
Delivery
We build what's needed: DPIAs, transfer agreements, certification readiness, DSAR programmes, or ongoing DPO coverage. Documented, defensible, done.
Services
What we deliver.
Practical privacy work — not just documentation, but controls that survive regulatory scrutiny.
GDPR Art. 42 Certification
End-to-end EuroPrivacy certification programme — Target of Evaluation, scope documentation, gap assessment, and auditor liaison.
DPIA & Transfer Impact Assessments
Art. 35 DPIAs and TIAs under EDPB Recommendations 01/2020 (EU) and ICO guidance (UK), covering complex processing and international transfers.
International Data Transfers
EU SCCs (Decision 2021/914), UK IDTA, India Accession Agreements, and supplementary measures across all applicable transfer routes.
Fractional DPO Services
Mandatory or voluntary DPO appointment (Art. 37). Ongoing compliance oversight, regulatory correspondence, and governance support.
Privacy Operations & DSAR
High-volume DSAR management, intake triage, SLA/KPI tracking, SOP development, and backlog reduction programmes.
Privacy by Design
Cross-functional work with Product, Engineering, and Support — data flow mapping, data minimisation, and privacy engineering integration.
EU AI Act Compliance
Risk classification of AI systems, conformity assessments, and documentation under the EU AI Act — covering GPAI models, high-risk systems, and prohibited practices.
Who we help
Built for companies that process real data at real scale.
We work with product and legal teams at B2B SaaS companies — typically ones that have grown fast, started selling into regulated markets, and realised their compliance programme hasn't kept pace. The work is practical, not theoretical.
Book a Free CallCase Study
From 0 to GDPR Art. 42 certified across 5 jurisdictions.
Client
International B2B SaaS platform (vehicle data)
Scope
EU, UK, US, Canada, Australia
Engagement
Mandatory DPO + GDPR Art. 42 certification
Took a B2B SaaS platform from zero privacy documentation to full GDPR certification readiness — two DPIAs, a complete international transfer suite (EU SCCs + UK IDTA + India Accession), and privacy notice compliance across four regulatory regimes.
Read the full case studyFAQ
Common questions.
If your processing involves large-scale tracking, sensitive data categories, or systematic monitoring — you almost certainly do under Art. 35 GDPR. The EDPB has published nine criteria; meeting two or more triggers a mandatory DPIA. We assess this in the discovery call.
EuroPrivacy certification is a third-party-verified signal that your platform meets GDPR requirements. Increasingly, B2B procurement teams require it. It also demonstrates due diligence to regulators and strengthens your position in DPA negotiations.
A DPIA for a well-scoped platform typically takes two to four weeks end-to-end. International transfer documentation depends on the number of routes and counterparties — a single IGDTA covering multiple modules runs three to six weeks. Certification programmes are longer engagements.
A DPO is a formally appointed function under Art. 37 GDPR — independent, with direct regulatory obligations. A consultant advises and delivers. Some engagements need both. We offer fractional DPO services for companies that need the formal appointment without the full-time hire.
If you offer goods or services to EU residents, or monitor their behaviour, GDPR applies regardless of where you're incorporated. The same extraterritorial logic applies under UK GDPR and increasingly under DPDPA (India). We work across all of these.
Documented outcomes
Results from real engagements.
Client names remain confidential. Outcomes are documented and verifiable.
DPIA · GDPR Art. 35
Mandatory DPIA obligation identified
A geofencing platform had never been told a DPIA was legally required under Art. 35. The gap assessment flagged it in week one — before regulatory exposure could materialise.
EU SCCs · UK IDTA · IGDTA
International transfer suite built from scratch
EU→US and EU→India transfer routes had no documentation at all. A full IGDTA covering three SCC modules, a UK IDTA, and an India Accession Agreement was drafted and executed.
Privacy notices · Multi-jurisdiction
15 privacy notice findings resolved
A B2B privacy notice audit identified 15 gaps against GDPR, UK GDPR, CCPA, and Australian privacy requirements — mandatory disclosure gaps, retention inconsistencies, missing jurisdictional coverage.
Art. 42 · EuroPrivacy · 5 jurisdictions
GDPR Art. 42 certification programme launched
From no compliance documentation to EuroPrivacy certification readiness across five jurisdictions — EU, UK, US, Canada, Australia — with full DPA suite and two DPIAs delivered.
Newsletter
Where Is My Privacy?
A weekly newsletter on data privacy — regulatory updates, practical GDPR guidance, and what the latest enforcement actions mean for your business. Written for founders, operators, and anyone who's ever asked: where did my privacy go?
Subscribe — it's freeNot sure where to start?
Book a free 30-minute call. We'll look at your specific situation — no sales pitch, just an honest assessment of where you stand and what you actually need.
Book Free Call