Plenty of shops will hand you a generic privacy policy and call it "GDPR compliant" in 48 hours. That's not how supervisory authorities read it. We map your actual data flows, document lawful basis per processing activity, and build the paperwork that survives a real inquiry.
No record of processing activities, no documented lawful basis, no DPA with your subprocessors — any one of these turns a routine customer inquiry into a supervisory authority complaint.
Tell us what EU personal data you collect and where it flows. No data processing agreements required to start.
Processing activities scored against Article 30, lawful basis flagged where it's missing, transfer mechanisms checked.
A ranked list of what to fix first — RoPA, DPIA, DPA, or DSAR process — within 24 hours.
High-level gap summary against Article 30 and a prioritized next step, in 24 hours.
Request Free ScanFull RoPA draft, lawful basis review, DPIA screening, and a 30-minute walkthrough.
Start with Free ScanRoPA, DPIAs, DPA/SCC drafting, DSAR process design, and supervisory-authority-ready documentation.
Start with Free ScanNo. A privacy policy swap takes an afternoon; documenting your actual processing activities, lawful basis, and transfer mechanisms under Article 30 takes real discovery time. A free readiness scan tells you honestly how much ground you're covering and how long it will take.
If you offer goods or services to people in the EU, or monitor their behavior — including through a website, app, or SaaS product — GDPR can apply regardless of where your company is incorporated. The free scan includes an applicability check as the first step.
A Record of Processing Activities under Article 30 documents what personal data you collect, why, where it goes, and how long you keep it. Most controllers and processors are required to maintain one, and it's the document a supervisory authority will ask for first in any inquiry.
Data subject access requests generally require a response within one month, extendable in limited cases. Missing that window is itself a compliance failure, separate from whatever the request uncovers. Tell us in the free scan if a request is already in flight and we'll flag the timeline first.
Yes, as part of a full engagement — but a compliant cookie banner without a RoPA or documented lawful basis behind it is cosmetic. We fix the underlying data mapping first, then the consent layer that sits on top of it.
Business context only — no sensitive documents yet. Initial response within 24 hours.