Protect personal data.
Build lasting trust.

Build a practical starting point around your activities, markets, and personal-data processing. Clarify the applicable framework and your responsibilities before choosing the work to prioritize.

• Map activities and locations relevant to GDPR applicability and local data protection rules.
• Clarify controller and processor roles with the appropriate advisers.
• Create a prioritized action plan with owners and review dates.

A defined scope and a clear sequence of improvements.

Connect business processes with the personal data they use. Document collection, storage, access, sharing, and deletion so teams can understand the information they are responsible for.

• Map customer, employee, supplier, and member data across systems.
• Support records of processing and review purposes, lawful bases, and retention with the responsible stakeholders.
• Identify unnecessary collection, duplicate storage, and deletion gaps.

A usable picture of personal data throughout its lifecycle.

Align notices and internal procedures with what actually happens in the organization. Coordinate legal review where needed and turn approved requirements into processes employees can follow.

• Support privacy notices and internal data-handling procedures.
• Review consent collection and withdrawal where consent is the appropriate basis.
• Assess website tracking and consent settings against applicable requirements.

Clearer information for individuals and practical guidance for employees.

Create an organized workflow for requests concerning personal data. Make responsibilities visible, from receiving and verifying a request to locating information and recording the response.

• Define intake, proportionate identity verification, and internal ownership.
• Support access, correction, erasure, and other applicable rights.
• Track deadlines, decisions, exceptions, and completion with the responsible team.

A repeatable process for handling requests consistently.

Connect data protection with technical and organizational safeguards. Define an incident process that helps teams recognize personal-data breaches, escalate concerns, and support timely decisions.

• Review permissions, secure sharing, and data-handling controls.
• Define incident reporting, assessment, escalation, and recordkeeping.
• Support assessment of notification duties with the responsible privacy and legal stakeholders.

Clear responsibilities for prevention and incident handling.

Review how new tools, suppliers, and processing activities affect personal data. Bring privacy considerations into procurement and change planning before implementation.

• Map processors, subprocessors, and international data flows.
• Coordinate review of processing agreements and transfer safeguards.
• Support privacy by design and DPIAs where processing is likely to create high risk to individuals.

Privacy questions considered before new processing begins.

Keep policies, system configuration, and employee practices aligned as the business changes. Assign accountability and create a manageable rhythm for reviewing progress.

• Provide practical awareness sessions around employees’ roles.
• Maintain action owners, evidence, and periodic review schedules.
• Coordinate with your DPO or advisers and clarify whether a formal DPO appointment is required.

An ongoing working practice, supported by evidence and accountable owners.