GDPR Start

Who it is for and when

Suits small and medium-sized organisations that process personal data but have no data protection function of their own, and that want a foundation they can maintain rather than a pack of documents that is left lying.

• Your GDPR work never really got going, or stopped after 2018.
• You have done a current state analysis and know what is missing, but not how to get there.
• A customer, owner or procurement asks how you handle personal data, and you want to be able to show it.
• You want to be able to run data protection yourselves afterwards, with support when needed.

What we do

1. Current state (gap) analysis. We go through your processing activities, documentation, roles and procedures against the requirements of the GDPR, in a start-up meeting with management and workshops with those who know the processing, for example HR, finance, sales and IT. If you already have a current state analysis, we start from it.
2. A prioritised plan. What matters most to the data subjects and to the business comes first, in an order you have time for.
3. The documentation is produced. Records, privacy information, the data protection policy, the retention plan and the overview of processors are written together with you, so that they match how you actually work.
4. The procedures are introduced. The procedures for personal data breaches and data subject rights are gone through with those who will use them, and management adopts the policy and the allocation of responsibilities.
5. Training. Management and staff receive training adapted to your business: what applies, what they should do and whom they ask.
6. Follow-up after 6 months. We go through what works, what has changed and what remains.

What we need from you

• A contact person who holds the work together on your side.
• Time for workshops with those who know the processing, often HR, finance, sales and IT.
• Existing agreements, policies, lists of systems and earlier analyses.
• Management decisions on the policy and the allocation of responsibilities.

Scope and price

A defined engagement. How long it takes depends on how many processing activities you have and how much is already in place; you get a plan with a timeline after the current state analysis. The documents are delivered in formats you can maintain yourselves, for example Word and Excel or in your existing tools.

Technical security measures in your systems and impact assessments are not included. We point out where they are needed, and they can be done as separate pieces of work.

GDPR Start gives a working baseline, not a guarantee of full compliance. No serious provider can promise that. What you get is a foundation you can show and build on.

We do not set a fixed price in advance. The price is assessed after the initial current state analysis, when we know how many processing activities you have and how much is already in place, and you then get a cost proposal for the rest of the work.

How it works

1. A first conversation. We listen to your situation and explain how we usually set up the work. You get our assessment straight away, free of charge.
2. A proposal with scope and price. A short written proposal with what is included, what you get, who does the work and what it costs.
3. Delivery and handover. We work together with your organisation, report as we go and hand over so you can maintain the result yourselves.