Most privacy programmes have gaps. Let's find yours before the regulator does.

If your processing involves large-scale tracking, sensitive data categories, or systematic monitoring, you almost certainly do under Art. 35 GDPR. The EDPB has published nine criteria; meeting two or more triggers a mandatory DPIA. We assess this in the discovery call.

EuroPrivacy certification is a third-party-verified signal that your platform meets GDPR requirements. Increasingly, enterprise customers and procurement teams require it. It also demonstrates due diligence to regulators and strengthens your position in DPA negotiations.

A DPIA for a well-scoped platform typically takes two to four weeks end-to-end. International transfer documentation depends on the number of routes and counterparties, a single IGDTA covering multiple modules runs three to six weeks. Certification programmes are longer engagements.

A DPO is a formally appointed function under Art. 37 GDPR, independent, with direct regulatory obligations. A consultant advises and delivers. Some engagements need both. We provide appointed DPO services, full-time, fractional, or interim, for companies that need the formal appointment.

If you offer goods or services to EU residents, or monitor their behaviour, GDPR applies regardless of where you're incorporated. The same extraterritorial logic applies under UK GDPR and increasingly under DPDPA (India). We work across all of these.