Know exactly where your data lives—before regulators ask

We need read-only access to systems containing personal data (databases, CRM, HR, marketing tools), system architecture diagrams, and stakeholder interviews. We don't need production data access—we analyze data types and flows, not individual records. All access is documented, time-limited, and covered by strict NDAs.

Investment ranges from CHF 25,000-75,000 depending on complexity: number of systems, data volume, international operations, and third-party integrations. Small companies (< 50 employees, < 10 systems) typically CHF 25k-35k. Mid-size (50-500 employees) CHF 40k-60k. Enterprise CHF 60k-75k+. Compare this to €20M GDPR fines or €50k-100k annual GDPR consultant costs.

We provide a prioritized remediation plan with risk levels (critical, high, medium, low). Critical violations (e.g., unprotected cross-border transfers) are flagged immediately with rapid fix guidance. We help you remediate violations before regulators discover them—which is the entire point of proactive assessment.

Yes. We regularly map hybrid cloud environments with data across AWS S3, Azure Blob Storage, GCP Cloud Storage, on-premise databases, SaaS tools (Salesforce, HubSpot, Zendesk), and third-party processors. We use automated discovery tools plus manual verification to ensure completeness.

We provide both: complete data map/ROPA AND functional DSAR response system. This includes documented workflows, request templates, data retrieval procedures, response formats, and team training. You'll be able to handle DSARs in-house after we complete—no ongoing dependency.

We include third-party analysis: identify all vendors processing your data, assess Data Processing Agreements (DPAs), evaluate sub-processors, and document transfer mechanisms. You'll have a complete vendor inventory with GDPR compliance status and remediation actions for non-compliant vendors.

We provide a living ROPA template with update procedures and schedules (typically quarterly reviews). We recommend data governance processes, system change controls, and annual re-assessments. Optional: we offer annual ROPA updates as a maintenance service (CHF 8k-15k/year).

Yes. Our deliverables are designed for regulatory scrutiny: documented methodology, evidence-based findings, compliant ROPA format, and audit trail. When regulators ask 'Do you know what personal data you process?', you'll have comprehensive, defensible documentation. We've supported 40+ regulatory audits with zero compliance findings.

Perfect—that's most of our clients. We guide you from zero. Week 1: kick-off workshop to identify key systems and stakeholders. Week 2-3: we do the heavy lifting (system analysis, interviews, documentation). Week 4-6: review findings together, prioritize remediation, implement DSAR system. You don't need existing documentation—we create everything.