GDPR implementation and DPO service

Home / Services / Security compliance / GDPR implementation and DPO service

The gold standard for personal data protection for Europe and the world

GDPR is the General Data Protection Regulation for the countries of the European Union (EU) and the European Economic Area (EEA). The document sets stringent requirements for the processing of individuals’ personal data.

The GDPR contains advanced principles of personal data and privacy protection, and the approaches to their implementation, which formed the basis of the relevant legislation in Japan, South Korea, China, Brazil, Argentina, Chile, etc. The California Consumer Privacy Act (CCPA) also contains many similarities to the GDPR.

Many companies ask two questions:

1. Why should we comply with GDPR if our company is not in the EU or EEA?

There is a reason. One of the features of the GDPR is its extraterritorial nature. This means that, in certain cases, the GDPR also applies to organizations outside the EU or EEA, for example when they offer goods or services to individuals in the EU or EEA or monitor their behavior there. For example, this applies to companies offering goods or services to individuals in the EU or monitoring their behavior there, including recording IP addresses and cookies of website visitors. If you work with EU legal entities, and your interaction involves gaining access to databases of EU individuals, then you and your European partners must also process such data in compliance with the GDPR requirements.

The GDPR principles are internationally recognized. Many advanced countries are guided by them in the development of domestic legislation. Incorporating these principles into your processes will help your company become more competitive in European and other markets.

2. What are the risks of non-compliance with the GDPR requirements? Can we be fined for this?

Yes, you can be fined. Depending on the circumstances, fines can reach €20 million or 4% of the company’s total worldwide annual turnover for the preceding financial year, whichever is higher. The fine can be applied both to European companies and to foreign legal entities, including those that do not have a representative office in the EU or EEA. And such cases already exist.

It is important for a foreign company to avoid the risks of being banned from doing business in the EU and the loss of reputation. The risks include blocking Internet resources that violate European legislation, or your European partners may refuse to work with you because they can be fined more easily than you.

H-X’s lawyers, managers, and security engineers will quickly help you understand if GDPR applies to your organization. Then we will analyze your business processes, identify inconsistencies and gaps, develop a technological and legal implementation plan. Finally, we will implement all necessary measures to eliminate the identified inconsistencies. This will increase your confidence, competitiveness, as well as your partners’ and customers’ loyalty, not to mention new prospects for your business development.

REQUEST A QUOTE

GDPR and ISO 27701 implementation stages. DPO service

Stage 0. Preliminary

This stage is free of charge. A preliminary analysis of your company’s activities to determine if you need to comply with the GDPR and ISO 27701 requirements. We invite you to fill in a questionnaire. We conduct interviews with your management and specialists and clarify the organization of your business processes. Based on the results, we will decide if you need to comply with the GDPR and ISO 27701 requirements or not.

Stage 1. Analytical

This stage includes the analysis of your company’s business processes to define the necessary organization, technical and legal measures in order to bring the company into compliance with GDPR and ISO 27701. During this stage, you fill out a detailed questionnaire. Our representatives conduct interviews with your management and specialists to collect findings and prepare for the GDPR training. You provide us with access to systems, contracts, and other documents for analysis. Based on the results of this work, we offer you a detailed report on the GDPR and ISO 27701 compliance or non-compliance of your processes, define the deficiencies and inconsistencies, and also offer organizational, technical, and legal measures to fill the gaps.

Stage 2. Implementation

Implementation of recommendations to eliminate the identified deficiencies and inconsistencies. Under the supervision and participation of our lawyers and technical specialists, the action plan is implemented to eliminate shortcomings and inconsistencies in business processes. In order to eliminate or minimize risks, where applicable, your business processes are adjusted. If necessary, we train and educate your specialists, providing comprehensive GDPR training for your employees.

Stage 3. Support + DPO

Ongoing support and Data Protection Officer services are key to maintaining compliance with GDPR and ISO 27701 requirements. Providing a Data Protection Officer (DPO) service, monitoring GDPR and ISO 27701 compliance, and providing advice in the course of ongoing activities are included in this stage. We provide DPO services in accordance with GDPR requirements. We monitor changes and application practices of GDPR and ISO 27701 certification. Our team also provides advice on GDPR and ISO 27701 compliance in the course of your current activities. In case of changes or additions to your business processes, legal requirements, or application of the law, we recommend adjusting your processes to comply with GDPR and ISO 27701 requirements.

Service summary

⏳ Project duration	Generally, 6 to 12 months, depending on the organization’s size, complexity, and data processing activities.
🎁 Can it be free or does it have a trial period?	Free consultation and initial analysis of business requirements. Use our virtual expert.
💼 What type of business needs it?	Online retailers, healthcare providers, financial institutions, marketing agencies and other businesses that handle personal data of EU citizens.
💡 When is this service needed?	When your organization handles personal data of EU citizens. The DPO is mandatory for certain types of organizations.
📈 Your profit	Reduced costs associated with data breaches and non-compliance fines, and increased customer trust.
⚙️ Our methods and tools	Identifying and evaluating information assets and risks, implementing security controls, and conducting audits to ensure compliance.
📑 Deliverables	Policies, assessment reports, security controls, data subject rights procedures, privacy notices, data breach response procedures, and periodic reports.

Check out our additional services and business cases. Send the form below to order GDPR and ISO 27701 implementation services. Get a free consultation.

REQUEST A QUOTE

FAQ

1️⃣ Why was GDPR implemented?

The General Data Protection Regulation (GDPR) was implemented to:

Protect privacy and personal data of European Union (EU) citizens
Replace the outdated 1995 Data Protection Directive
Create a uniform data protection standard across the EU
Strengthen individuals' rights regarding their personal data
Hold organizations accountable for data protection

Key features:

Adopted: April 14, 2016
Enforceable: May 25, 2018
Applies to organizations within the GDPR’s territorial scope, including certain non-EU organizations that offer goods or services to individuals in the EU or monitor their behavior there
Requires a valid legal basis for processing personal data; consent is one of several possible legal bases
Requires controllers, where applicable, to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it
Imposes significant penalties for non-compliance (up to 4% of global revenue or €20 million)

2️⃣ Who implements the GDPR?

GDPR implementation is a collaborative effort involving:

National Data Protection Authorities (DPAs) of EU member states
European Data Protection Board (EDPB)

Roles:

DPAs: Oversee and enforce GDPR compliance within their jurisdictions
EDPB: Ensures consistent GDPR application across the EU, provides guidance, and resolves disputes

The EDPB comprises representatives from each EU member state's DPA and has the power to issue binding decisions on GDPR-related issues.

3️⃣ What is a GDPR audit?

A GDPR audit is an evaluation of an organization's compliance with the General Data Protection Regulation. It:

Can be conducted by internal or external auditors
Assesses whether an organization meets its GDPR obligations
Identifies areas of non-compliance or potential risk
Provides recommendations for addressing issues
May require corrective action if non-compliance is found

4️⃣ What is GDPR?

The General Data Protection Regulation (GDPR) is an EU regulation that:

Protects privacy and personal data of EU citizens
Applies to organizations within the GDPR’s territorial scope, including certain non-EU organizations that offer goods or services to individuals in the EU or monitor their behavior there
Creates a uniform data protection standard across the EU
Strengthens individuals' rights regarding their personal data

Key points:

Adopted: April 14, 2016
Enforceable: May 25, 2018
Defines personal data as any information that can identify an individual
Requires a valid legal basis for processing personal data; consent is one of several possible legal bases
Grants individuals rights to access, correct, and erase their data
Requires controllers, where applicable, to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it
Imposes significant penalties for non-compliance (up to 4% of global revenue or €20 million)

The GDPR aims to hold organizations accountable for protecting individuals' privacy and personal data in the digital age.

5️⃣ Who does GDPR apply to?

GDPR applies to:

All organizations processing personal data of EU residents
EU-based organizations
Non-EU organizations offering goods/services to EU individuals
Organizations monitoring behavior of EU individuals

Key points:

Applies regardless of organization location
Covers any information that can identify an individual
Requires compliance with GDPR requirements
Grants individuals rights regarding their personal data

6️⃣ What is a Data Protection Officer (DPO)?

A DPO:

Oversees the organization's data protection strategy
Ensures compliance with data protection regulations
Acts as a point of contact for stakeholders and authorities
Requires expert knowledge of data protection laws
Must be independent and impartial

7️⃣ How to audit GDPR compliance?

Steps for auditing GDPR compliance:

Develop a checklist of GDPR requirements
Identify audit scope
Review policies and procedures
Assess technical measures
Evaluate organizational measures
Review third-party agreements
Conduct stakeholder interviews
Document findings and recommendations
Follow up on identified issues

8️⃣ When should a company have a DPO?

A company must appoint a DPO if it:

Has core activities that involve regular and systematic monitoring of data subjects on a large scale
Processes sensitive data on a large scale
Has core activities that require regular and systematic monitoring of data subjects on a large scale
Is a public authority or body (except courts acting judicially)

Companies may voluntarily appoint a DPO to demonstrate commitment to data protection.

9️⃣ How many DPOs are needed for implementation?

There is typically one DPO per organization. Key aspects of DPO implementation: