Question 1

Do we need to appoint a Data Protection Officer?

Accepted Answer

A DPO is mandatory under Article 37 if you are a public authority, your core activities involve regular and systematic monitoring of data subjects on a large scale, or you process special categories at scale. Many organisations that are not strictly required to appoint one still benefit from designating a privacy lead. We help you run the formal assessment and document either the appointment or the justification for not appointing.

Question 2

How comprehensive does the RoPA actually need to be?

Accepted Answer

Your RoPA must list all processing activities under Article 30 — controller and processor roles separately, the categories of data, recipients, retention periods, and where applicable the international transfer safeguards. Supervisory authorities consistently request the RoPA first in any enquiry, so it must be defensible, current, and consistent with what your systems actually do.

Question 3

What is the realistic timeline for DSR responses?

Accepted Answer

GDPR Article 12(3) gives you one month, extensible by two more months for complex requests if you notify the data subject. In practice, regulators expect acknowledgment within a few days and substantive response well inside the month. Our DSR workflow includes templates, identity verification, and a tracking spreadsheet that holds up to scrutiny.

Question 4

How does GDPR apply to AI and automated decision-making?

Accepted Answer

Article 22 restricts solely-automated decisions with legal or similarly significant effect, requires meaningful information about the logic involved, and triggers a DPIA in most cases. With the EU AI Act now overlapping, we deliver a single DPIA + AI Act conformity package rather than parallel paperwork.

Question 5

What about international transfers after Schrems II?

Accepted Answer

You need an adequacy decision, Standard Contractual Clauses (2021 modules), or BCRs, plus a transfer impact assessment for non-adequate destinations. The EU-US Data Privacy Framework restored some routes for US transfers but does not replace the per-recipient TIA. We deliver a transfer register with the safeguard mapped to each flow.

Question 6

What are typical penalty levels and what triggers them?

Accepted Answer

GDPR fines reach €20M or 4% of global turnover for the most serious infringements (Article 83(5)) — typically lawful basis, transparency, or transfer breaches — and €10M or 2% for the rest. Most enforcement we see is triggered by data-subject complaints, breach notifications, or sectoral regulators referring cases. The deciding factor is usually whether you can show a defensible programme, not whether the breach happened.

GDPR programmes that satisfy the EDPB and pass the audit

What you get in 90 days

Programme baseline and DPO determination

RoPA, DSR procedure, DPIA template, breach playbook

Audit-ready evidence pack and DPO operational handover

Our GDPR Integration Method

GDPR Readiness Assessment

Deliverables:

Consent & AI Framework Design

Deliverables:

Cross-System DSAR Automation

Deliverables:

Operational Integration

Deliverables:

Expected Outcomes

Frequently asked questions

Ready to start? Book a 30-min scoping call.