Data protection & GDPR

1. Brief service summary

Prepare a data protection approach suited to your organisation’s processing activities. The engagement helps identify the information, responsibilities and measures to examine, without presuming that a legal framework applies solely because it appears in the service title.

2. Your needs

Your organisation collects or uses data about individuals, but uses, access and exchanges are not always documented. You wish to understand which processing activities to examine and what information to assemble before defining the necessary actions.

You seek an approach that distinguishes legal requirements, the organisation of practices and technical security.

3. Objectives of the engagement

The engagement aims to map the processing activities included in the scope, identify the parties involved and prepare questions of applicability and responsibility. It helps prioritise documentary, organisational and technical measures for examination.

Legal conclusions are conditional on examination of the context and confirmation of the requisite expertise.

4. Indicative scope

The work may cover stated purposes, data categories, individuals concerned, recipients and access conditions. Retention periods, exchanges and service providers are examined using the available information.

The applicability of the GDPR or other frameworks must be checked according to the activities and countries concerned. Documentation, information and request-handling needs are specified without automatically imposing universal rules.

5. Possible delivery arrangements

Interviews, review of materials and mapping workshops may be used. Analysis prioritises descriptions of processing activities and the necessary documents; no access to live personal data is presumed required or authorised.

6. Possible deliverables

Deliverables may include a processing map, a record of applicability questions and an action plan identifying documents to prepare or submit for validation.

7. Conditions and limitations

The engagement does not constitute GDPR certification. Appointment to a particular function, legal opinions, technical audits and incident response require separate scoping. No external transfer or change of access is automatically included. Service 19.10 addresses responsible operational data-use practices more broadly.