GDPR + LOPDGDD
Data protection that survives a regulator inspection. We combine legal and technical work so compliance does not stay on paper.
Regulation (EU) 2016/679
- What is at stake
- Up to €20M or 4% of global turnover
Who it applies to
- Any company processing personal data
- Organisations with health or children’s data
- Companies with international transfers
Typical timeline
2 to 4 months
Regulation (EU) 2016/679
In detail
Protecting personal data is a technical duty, not just a legal one.
The General Data Protection Regulation (EU) 2016/679 applies to any organisation processing data of people in the EU. It defines how that data is collected, used, stored and deleted.
Article 32 requires technical and organisational measures appropriate to the risk: encryption, access control, the ability to restore data and regular testing of their effectiveness. This is where security and privacy meet.
Data breaches must be reported to the supervisory authority within 72 hours and, if the risk is high, also to affected individuals. Spain’s AEPD is one of the most active authorities in Europe for fines.
Real scenarios
Where we usually help.
Data breach
We assess scope and risk to individuals and prepare the authority notification with the required documentation.
New product with sensitive data
We run the impact assessment and design security measures before launch: privacy by design.
International transfers
We review non-EU suppliers and the safeguards needed, such as standard contractual clauses or the EU-US Data Privacy Framework.
What you get
What you will have at the end.
- Records of processing activities
- Risk analysis and DPIA
- Technical security measures in place
- Data processing agreements
- Breach management procedure
- Staff training
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
RGPD
What we focus on
- 01
Records of processing activities
- 02
Data protection impact assessments
- 03
Technical security measures
- 04
Breach handling and 72 h notification
GDPR + LOPDGDD
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for GDPR + LOPDGDD cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Do I need a Data Protection Officer?
It is mandatory for public authorities and companies processing sensitive data at scale or doing systematic monitoring, such as hospitals or insurers.
Which security measures exactly?
GDPR gives no closed list: it requires measures appropriate to the risk. In practice, ISO 27001 and ENS are accepted references to demonstrate it.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.