Data Protection & Privacy
Kristensson i Skåne AB helps organisations build and improve their data protection work under the GDPR. Support can include current-state and gap analysis, records of processing activities, impact assessments, policies, personal data breaches and ongoing data protection advice. The work is done by consultants who combine legal competence with a technical security background.
The GDPR is not just law. Data protection that works needs law, processes, information security and technology to fit together, and that is how we work: the same team can assess the legal basis for a processing activity, set up retention in Microsoft 365 and write the personal data breach procedure. We start where you are, do what has the greatest effect first and hand over a way of working you can maintain. The team holds certifications in both data protection and information security; see our team.
In brief
- Who
- Organisations that process personal data, which is most companies and organisations
- What
- GDPR programmes, ongoing data protection support and an external data protection officer, DPIAs, records of processing activities, breach preparedness
- How
- Current state, prioritised plan, implementation and maintenance, together with your organisation
Which support suits you?
Four ways to start, depending on how far your data protection work has come.
We do not know where we stand
A documented current state against the GDPR, gaps per requirement and a prioritised action plan management can decide on.
GDPR current-state and gap analysis →We need to get the GDPR in order
We start with a current state analysis and then take you to a working baseline: records, privacy information, procedures and responsibilities.
GDPR Start →We need ongoing help but no data protection officer
Senior support for records, agreements, questions, breaches and new systems, from a few hours a quarter to every week.
Ongoing GDPR support →We need a data protection officer
We assess whether you must appoint one and take the role, with a named deputy, or support the person you appoint.
External data protection officer (DPO) →The GDPR divided into 15 parts
If you divide the GDPR into 15 parts, it becomes clear what the work covers. The division is our way of breaking the requirements down into three areas: responsibility has to be decided first, and mapping the processing is the foundation for most of the rest. This is what each part looks like when it is in place.
Governance and accountability
- Management, responsibilities and roles. A decision on who owns the data protection work, who does what and who in management follows it up.
- Data protection officer. A documented assessment of whether you must appoint one and, if so, who it is.
- Policies and procedures. A data protection policy adopted by management, and procedures that describe how you work in practice.
- Training and awareness. Those who handle personal data know the rules, and you can show who has been trained.
- Follow-up and reporting. Recurring checks that the procedures are followed, and a report to management at least once per year.
Processing activities
- Mapping and data flows. Which personal data you hold, where it is and where it is sent.
- Purpose and legal basis. A purpose and a legal basis for each processing activity, for sensitive personal data also an exception under Article 9, and consents you can show and that can be withdrawn.
- Record of processing activities. An Article 30 record that is kept up to date as the business changes.
- Retention and deletion. Decided retention periods, and data that is actually deleted when the time has passed.
- Information to data subjects. Privacy information under Articles 13 and 14 for customers, employees, job applicants and website visitors, matching the processing that actually takes place.
Rights, security and risk
- Data subject rights. A procedure for answering requests within one month, on access, rectification, erasure, restriction, objection and data portability, and for questions about automated decisions where relevant.
- Suppliers and transfers. Data processing agreements with your suppliers, and a valid basis for each transfer outside the EU/EEA, with a transfer impact assessment where one is required.
- Security measures. Technical and organisational measures proportionate to the risks, for example access control, multi-factor authentication and backups.
- Impact assessments and data protection by design. A data protection impact assessment (DPIA) where the risk is high, and data protection included from the start when new systems are introduced.
- Personal data breaches. A procedure for assessing breaches and notifying IMY within 72 hours when required, and a log of all breaches.
How the work is done
Current state and gaps
We go through your processing activities, documentation, roles and routines against the requirements of the GDPR, and identify the gaps and the risks.
Priorities and plan
An action plan with realistic timelines, the most critical compliance gaps first, agreed with management.
Implementation
Records of processing, governing documents, routines for data subject rights, DPIAs and breach handling are put in place together with your organisation.
Management and follow-up
DPO support, training, supplier follow-up and recurring reviews, so the work holds over time.
Want to know how we work in each step? Read the detail further down the page →
Offers in data protection
Each offer can be bought on its own or combined into a coherent data protection programme.
GDPR current-state and gap analysis
Where do you stand against the GDPR today? A documented current state, identified gaps and a prioritised action plan that management can decide on.
You get: a documented current state, identified gaps, a prioritised action plan and a review with management.
Scope: defined engagement, a few days to about a week depending on sizeRead more → ImplementationGDPR Start
We start with a current state analysis and then take you to a working baseline: records, privacy information, policy, procedures and training.
You get: a current state analysis, a prioritised plan and the documentation and procedures that are missing, with a follow-up after 6 months.
Scope: defined engagement with a follow-up after 6 monthsRead more → Ongoing supportOngoing GDPR support
Operational support for records, agreements, questions, breaches and new systems, with or without a data protection officer.
You get: a senior contact person, documentation kept up to date and reporting to management.
Scope: ongoing, per quarter, month or weekRead more → Ongoing supportExternal data protection officer (DPO)
We take the role of external data protection officer or support your own: the officer informs, advises, monitors compliance and reports to management. The operational work is kept separate from the monitoring.
You get: an appointed officer or support for your own, ongoing advice, follow-up and reporting to management.
Scope: ongoing, a number of days per monthRead more → Projects and systemsImpact assessments (DPIA) and privacy by design
DPIAs for high-risk processing, for example when a customer or procurement requires one before signing, and privacy built into projects and systems from the start.
You get: completed DPIAs with documented measures and residual risk, and a method for privacy by design in your projects.
Scope: per assessment, or as part of a projectRead more → WebsiteWebsite review: cookies and public privacy notice
Cookies and the consent banner, the public privacy notice, forms and third-party services on your website.
You get: a list of cookies and tags before and after consent, and a prioritised list of fixes.
Scope: defined review of one websiteRead more → StructureRecords of processing activities and data lifecycle
Article 30 records, data mapping, retention and deletion policies and routines for secure archiving and deletion.
You get: mapping, records of processing activities, retention and deletion rules and routines for deletion.
Scope: defined engagement with handover to youRead more → PreparednessPersonal data breaches
Procedures to detect and assess breaches, and to notify the supervisory authority without undue delay and where feasible within 72 hours when the breach is notifiable, exercises and documentation that show you are in control.
You get: a breach procedure with roles and a 72-hour flow, an exercise and documentation that holds.
Scope: defined engagement, exercise as an optionRead more → SuppliersData processing agreements and suppliers
We assess suppliers’ data protection, set the right contractual requirements, review sub-processors and transfers outside the EU/EEA, and follow up that what was agreed is complied with.
You get: reviewed agreements, risk-assessed suppliers and a follow-up routine.
Scope: defined engagement, or part of ongoing supportRead more →Frequently asked questions
What is the difference between a controller and a processor?
The controller decides why and how personal data is processed and carries the main responsibility under the GDPR. The processor handles personal data on behalf of the controller, according to instructions and a data processing agreement. Both have obligations, but the controller is accountable to the data subjects and the supervisory authority.
What legal basis do we need to process personal data?
All processing of personal data needs a legal basis under the GDPR, for example contract, legal obligation, legitimate interest or consent. The organisation must also be able to demonstrate purpose, proportionality, transparency and compliance with the basic principles. Sensitive personal data also needs an applicable exception under Article 9, and data on criminal offences is subject to specific rules under Article 10.
When is a data protection impact assessment, DPIA, required?
A DPIA is required when processing is likely to result in a high risk to the rights and freedoms of individuals, for example sensitive data, extensive monitoring or new technology with a large impact. The assessment is based on the overall risk of the processing; a single factor does not always mean that a DPIA is required.
How does data protection relate to information security?
Data protection requires appropriate technical and organisational security measures. Information security helps the organisation protect personal data against unauthorised access, loss, incorrect changes and unlawful use.
How can we improve our GDPR work in practice?
Start with records of processing activities, clear roles, legal bases, data processing agreements, procedures for data subject rights, breach handling and regular follow-up of risks and controls.
Can Kristensson coordinate NIS2, CRA, GDPR and ISO 27001?
Yes. Kristensson can help the organisation identify common requirements, reduce duplicate work and at the same time handle the requirements that are specific to each regulation or standard. Data protection then becomes part of coherent governance instead of a separate track.
Do we have to appoint a data protection officer?
Yes, if you are a public authority or body, if your core activities involve regular and systematic monitoring of individuals on a large scale, or if you process special categories of personal data or data on criminal convictions on a large scale. Other organisations may appoint a DPO voluntarily. We help you assess whether the role is required and how it should be staffed. Read more in When does an organisation need a data protection officer?
How is an external data protection officer priced?
It varies from engagement to engagement. The set-up depends on the size of the organisation, how many and how sensitive the processing activities are and how much ongoing support you need. We go through the arrangement that suits you in a first conversation.
What is the difference between a data protection officer and a data protection lead?
The data protection officer is an independent role under the GDPR that informs, advises and monitors compliance. The person who owns and drives the practical data protection work in the business is often called the data protection lead or coordinator. The roles complement each other and should be kept apart to avoid conflicts of interest.
Do you help with data protection in Microsoft 365?
Yes. Much of data protection is decided in the tools: who has access, how sharing and storage are set up, how long data is kept and how sensitive information is labelled and protected. We work on both sides, the assessments under the GDPR and the settings in Microsoft 365, for example information classification and labels in Microsoft Purview. Read more about Microsoft 365.
How we work with data protection, in detail
For those who want to know how we set up the work in each part. Jump to a section in the menu, or read from the top. About 7 minutes of reading
GDPR Programme Support & Implementation
We design and execute GDPR compliance programmes tailored to your organisation. This begins with a thorough assessment of your current data protection posture to identify gaps and risks. Based on this analysis, we develop a clear remediation roadmap with prioritised activities and realistic timelines, ensuring focus on the most critical compliance gaps first.
Our experts help establish all the foundational elements of a privacy programme, from drafting privacy policies and procedures to creating records of processing activities (GDPR Article 30 registers) and other required documentation. That includes the information to data subjects under Articles 13 and 14, for example privacy information for customers, employees, candidates and website visitors, which needs to match the processing that actually takes place and be kept up to date when systems, suppliers or purposes change. We assist in defining roles and responsibilities (including Data Protection Officer considerations) and securing management support, so your GDPR initiative is well-governed and resourced from the start.
In brief
- Assessment of the current data protection posture, gaps and risks
- Remediation and improvement plan with priorities and realistic timelines
- Privacy policies, procedures, records of processing activities (Article 30) and information to data subjects (Articles 13 and 14)
- Roles and responsibilities, including the data protection officer, and anchoring with management
Ongoing Privacy Operations
Data protection is not a one-time project – we provide ongoing support to maintain and improve your privacy programme. This can mean that we serve as your external data protection officer or give specialist support to an existing one. The role is advisory and monitoring: the officer informs, advises, monitors compliance and reports to the highest level of management. The GDPR allows the DPO to hold other tasks as long as they do not create a conflict of interest, but whoever monitors the data protection work should not also be taking the decisions about the processing. We implement structured privacy governance (e.g. annual compliance plans) to ensure continuous control, review, and improvement. Regular check-ins and reports to leadership keep everyone informed of the privacy programme status.
The operational data protection work is a separate engagement, distinct from the DPO role. We can maintain records of processing activities, administer data subject requests (access, rectification, erasure, restriction, objection and data portability, and questions about automated decisions where relevant), and support risk management where applicable. Where we take the DPO role, the operational work is carried out by someone else, so that the independence holds. We also coordinate periodic training and awareness programmes to keep your staff educated on privacy practices, making data protection an integral part of your company culture. We also help you assess processors and other suppliers, set the right requirements in the data processing agreements, review sub-processors and follow up that what was agreed is complied with. We map where the data is processed and from where it is accessed: when personal data is made available outside the EU/EEA, we assess which basis exists under Chapter V, for example an adequacy decision or Standard Contractual Clauses, and whether supplementary measures are needed.
In brief
- External data protection officer (DPO) or support for your own, in an advisory and monitoring role kept apart from the operational work
- Annual compliance plans, follow-up and reports to management
- Records of processing activities, data subject rights and risk management in everyday operations
- Training and awareness, suppliers, sub-processors and transfers outside the EU/EEA
Data Governance & Lifecycle Management
Understanding your data is key to protecting it. We help you create a comprehensive inventory of personal data in your systems – mapping what data you have, where it resides, and how it flows between processes. By establishing clear data governance processes, including data classification and ownership, we help you manage personal data consistently and lawfully throughout its lifecycle. These practices give you visibility into your information assets and support compliance efforts like fulfilling data subject rights and reporting obligations.
Our services cover the full data lifecycle, from collection to deletion. We develop and implement retention policies that define how long personal data should be kept and when it must be disposed of. To enforce these policies, we introduce procedures and technical measures for secure archiving and deletion (so data is not kept longer than necessary). This includes setting up routines for regular data clean-up and ensuring that backups and archives are managed in compliance with GDPR. By applying data minimisation and timely deletion of data, you reduce risk and storage costs while meeting regulatory requirements. Our data governance approach not only keeps you compliant, but also improves data quality and integrity – so you can trust that the information you retain is accurate, relevant, and well-protected.
In brief
- Inventory and mapping of personal data and data flows
- Data classification, ownership and consistent handling across the lifecycle
- Retention and deletion policies and secure archiving and deletion
- Data minimisation that reduces both risk and storage cost
Privacy by Design & Technology Integration
We integrate Privacy by Design principles into your product development and IT projects from the outset. Our consultants work with your teams to ensure that any new system, application, or process is built with data protection in mind. Concretely, this means we identify potential privacy risks early and specify controls to mitigate them – for example, ensuring that applications only collect necessary data, that personal data is encrypted or pseudonymised where appropriate given the risk and the nature of the processing, and that access to personal data is restricted on a need-to-know basis. We establish review checkpoints (such as privacy impact assessments in project workflows or a privacy review board) so that privacy considerations are addressed before new initiatives go live. By weaving privacy into design and procurement processes, we prevent issues and costly rework down the line.
When planned processing is likely to result in a high risk to people’s rights and freedoms, we carry out a data protection impact assessment (DPIA) before the processing starts. We describe the processing, assess necessity and proportionality, identify the risks to the data subjects and document the measures needed to reduce them. If a high risk remains despite the planned safeguards, prior consultation with IMY has to be considered before the processing starts (Article 36). We also advise on and help implement privacy-enhancing technologies, such as anonymisation/pseudonymisation techniques, encryption solutions, and consent management tools. Through these measures, privacy and security are built into your IT environment by default, supporting compliance and boosting customer confidence in your digital services.
In brief
- Privacy requirements and controls specified early in projects and procurement
- Checkpoints such as DPIAs in project flows and a privacy review board
- Data protection impact assessments (DPIAs) for high-risk processing
- Privacy-enhancing technology: pseudonymisation, encryption and consent management
Breach Preparedness & Accountability
Being prepared for a data breach is a crucial part of privacy protection. We help you develop and refine incident response plans specifically for personal data breaches, often in coordination with your broader IT security incident plans. This includes defining clear procedures to detect and assess potential data breaches, containment steps to minimise damage, and communication protocols to notify the proper authorities and affected individuals when required. Every personal data breach is documented and risk-assessed. Unless the breach is unlikely to result in a risk to the rights and freedoms of the data subjects, the controller must as a rule notify IMY within 72 hours of becoming aware of it, and where the risk is likely to be high, those affected normally need to be informed without undue delay. If you are a processor, we set up procedures for notifying the controller without undue delay. We prepare you to gather the necessary information quickly. Through simulations and tabletop exercises, we can test your breach response process so that your team is ready to act decisively and calmly in the event of a real incident.
We instill a strong sense of accountability in your privacy programme, helping you document and provide evidence of compliance in everything you do. Our consultants establish governance practices to record decisions and actions related to data protection – in line with the accountability principle in Article 5(2): the controller is responsible for complying with the GDPR’s basic principles and must be able to demonstrate how. We keep the necessary documentation in place and up to date, from records of processing activities and documentation of consent, where consent is the legal basis, to privacy policies, risk assessments, and training records. If regulators or auditors come knocking, you will have a well-organised trail of how you manage data protection. We also perform periodic compliance audits and gap assessments to verify that controls are working as intended and to recommend improvements. By continuously monitoring and enhancing your privacy measures, we help you not only meet legal requirements but also build trust with customers and partners through transparency and diligence.
In brief
- Incident response plans for personal data breaches, coordinated with IT security
- Procedures to detect, assess, contain and communicate
- A risk assessment of every breach, notification to IMY within 72 hours when required, and exercises
- Documentation and evidence that demonstrate compliance (accountability)
With Kristensson i Skåne AB as your data protection partner, you gain a trustworthy advisor committed to safeguarding personal data and supporting your compliance journey. Our senior privacy specialists bring extensive experience across various industries, ensuring that our solutions are both pragmatic and aligned with best practices. We tailor our services to your unique needs – whether you are establishing a privacy programme from scratch or refining mature processes – and always aim to empower your organisation to confidently protect sensitive information. Want to know what it would look like for you? Contact us and we will tell you more. Read more about how we work and about external data protection officer.
Unsure which regulations affect you? Take the regulations self-test and get a first indication on the GDPR, the Swedish Cybersecurity Act, DORA, the CRA, the AI Act and requirements through customers.
Want to know more about how we can strengthen your data protection?
Contact us