27kay 27kay

GDPR Compliance

Practical GDPR compliance for your business - from assessing where you stand to implementing processes that actually work.

GDPR without the panic

GDPR doesn’t have to be a boogeyman. At its core, the regulation asks one simple thing: handle the personal data you process responsibly. We help you achieve GDPR compliance with processes your team will actually follow - not a stack of documents nobody reads.

How we work

We assess what you’re already doing

Before we create anything new, we understand your current state. Many companies are already doing most things right without realizing it. We identify the gaps and prioritize by real risk, not theoretical severity:

We implement GDPR processes that work

We don’t hand you template policies and walk away. We work with your team to build processes that fit the reality of your business:

We train your team

GDPR compliance isn’t just documentation - your people need to understand what it means in practice. We run training sessions people remember, because they’re concrete and connected to their everyday work.

GDPR and ISO 27001 - better together

If you already have or are planning ISO 27001 certification, a large part of the security work overlaps with the measures Article 32 asks you to choose. A certificate is not a finding that Article 32 is met. We help you integrate the two frameworks instead of duplicating effort. ISO/IEC 27701:2025 can be certified on its own, or integrated with the ISMS. It’s no longer an extension that requires ISO 27001 first. Our approach is always practical - one system that satisfies the requirements you actually have.

Why work with us

Next step

Not sure how well your company meets GDPR requirements? Let’s talk - we’ll give you an honest assessment of what’s already in good shape and what genuinely needs improvement.

Frequently Asked Questions

Do we need a Data Protection Officer (DPO)?
Article 37 requires a DPO for public authorities, other than courts acting in their judicial capacity. It also requires one where the core activities are large-scale regular and systematic monitoring, or large-scale processing of Article 9 or Article 10 data. Large-scale special-category processing that is not a core activity does not trigger it. Many startups are outside that. Having someone responsible for privacy is still a good idea.
What happens if we get a data subject access request?
Article 12(3) gives you one month from receipt, not 30 days. That month can be extended by two further months where the request is complex or you have many requests. You must tell the person about the extension, and the reasons for the delay, within the first month. We help you set up a process so these requests don't cause panic.
How does GDPR relate to ISO 27001?
There's significant overlap. An ISO 27001 ISMS is one way to organize the technical and organizational measures Article 32 asks for. It does not define what is appropriate, and a certificate is not a finding that Article 32 is met. If you already have an ISMS, you're well on your way. We integrate the two frameworks so you don't duplicate effort.
What are the real penalties for non-compliance?
Fines can reach up to 4% of annual global turnover or 20 million euros, whichever is higher. In practice, regulators tend to focus on companies that show clear negligence. Demonstrating genuine effort toward compliance goes a long way.
How long does a GDPR compliance project take?
It depends on what you already have. A company with a working register and a known vendor list is a shorter project than one starting from nothing. It isn't a one-time project. We help you build processes that sustain it.