Data protection that works in daily business and stands up to authorities, customers and auditors
ADVISORI advises mid-sized companies, SMEs and enterprises on implementing the General Data Protection Regulation (GDPR): from the data protection audit through records of processing, processor contracts and data protection impact assessments to ongoing data protection management.
The GDPR requires every company to know which personal data it processes and for what purpose, to have a legal basis for each processing activity and to be able to demonstrate this at any time (accountability, Art. 5(2) GDPR). GDPR consulting establishes where you stand, closes the gaps and sets up procedures for handling data subject requests, data breaches and new projects reliably. Infringements can be fined with up to EUR 20 million or 4 percent of worldwide annual turnover.
Our consulting covers the whole path: review, implementation and ongoing operation. You decide whether we take on a defined project, strengthen your data protection team or hold the data protection officer mandate. Mid-sized companies and SMEs get a lean, complete baseline; enterprises get uniform governance across entities and countries.
6 service modules
We check processing activities, systems, contracts and documents against the GDPR requirements and show where action is needed.
We build your data protection management or bring an existing one up to date.
ADVISORI takes on the role of data protection officer as a mandate. You meet the appointment duty under Art. 37 GDPR without creating a position of your own.
We review your service providers and draft the contracts.
We assess high-risk processing before it starts and anchor data protection in systems and processes.
We keep your data protection current and are available when something happens.
5 phases
From the first call to ongoing operation in five steps.
clarify starting point, scope and goals
review processing, contracts, documents and measures
order gaps by risk, assign owners and dates
create or revise records, contracts, processes and training
controls, review of new projects, report to management
Your contact
Melanie Düring
Head of Risk Management
We support organisations comprehensively in implementing the GDPR, from the initial analysis through to full integration into operational processes. Through practical solutions and continuous support, we create the assurance that all data protection requirements are met on a lasting and effective basis.
New software, cloud services, AI applications and service providers change processing all the time. Data protection is effective only when records, contracts and measures are maintained and new projects are reviewed before they start.
10 QUESTIONS, BRIEFLY ANSWERED
GDPR consulting establishes where a company stands against the General Data Protection Regulation and closes the gaps. It covers an inventory of processing activities, the records of processing under Art. 30, legal bases and information duties, data processing agreements under Art. 28, technical and organisational measures under Art. 32, data protection impact assessments under Art. 35, and procedures for data subject requests and data breaches. The result is data protection management that works in daily business and can be evidenced to supervisory authorities, customers and auditors.
It starts with a data protection audit: processing activities, systems, contracts and existing documents are checked against the GDPR requirements. This produces an action plan ordered by risk. During implementation, records, policies, contracts and processes are created or revised and employees are trained. The engagement then moves into ongoing support, with regular controls and reviews of new projects such as new software, cloud services or AI applications.
The GDPR (General Data Protection Regulation, EU 2016/679) has been binding across the EU since May 2018. It governs the protection of personal data and applies to all organisations that process data of EU residents, regardless of where the organisation is based. Non-compliance can result in fines of up to €20 million or 4% of global annual turnover, whichever is higher.
Under Article 37 GDPR, a Data Protection Officer is mandatory when at least 20 employees regularly process personal data, when large-scale processing of special category data occurs such as health data, or when systematic monitoring of individuals takes place. Public authorities must always appoint a DPO. The DPO can be an internal employee or an external service provider and must be formally registered with the supervisory authority.
The GDPR provides for two tiers of fines: up to EUR 10 million or 2% of global annual turnover for infringements of organisational obligations such as a missing Record of Processing Activities. Up to EUR 20 million or 4% of global turnover for serious violations of data protection principles, data subject rights, or international transfers. European supervisory authorities issued over EUR 2 billion in GDPR fines between 2018 and 2024.
A Data Protection Impact Assessment under Article 35 GDPR is mandatory when processing is likely to result in a high risk to individuals' rights and freedoms, for example profiling, health data processing, or systematic CCTV monitoring. The DPIA assesses risks, identifies safeguards, and documents whether the processing is justified. Failure to conduct a mandatory DPIA can result in fines of up to EUR 10 million.
Key GDPR requirements include: a lawful basis for all data processing such as consent, contract, or legitimate interest; a Record of Processing Activities under Article 30; Technical and Organisational Measures to ensure data security; data subject rights covering access, erasure, rectification, and portability; data breach notification within 72 hours to supervisory authorities under Article 33; and Privacy by Design and by Default principles embedded in all new systems and processes.
GDPR, NIS2, and ePrivacy form an interconnected European data protection framework. GDPR governs personal data protection and data subject rights. NIS2 mandates cybersecurity measures for critical infrastructure operators, including incident reporting within 24 hours. When a security breach also involves personal data, organisations must comply with both GDPR's 72-hour breach notification under Article 33 and NIS2 reporting requirements simultaneously. ADVISORI provides integrated compliance advice across all three regulations.
The right to erasure under Article 17 GDPR entitles individuals to request deletion of their personal data when it is no longer necessary for the original purpose, consent is withdrawn, or the data has been unlawfully processed. Organisations must respond within 30 days. Exceptions apply when data is required for legal claims or public interest purposes. Technical implementation requires deletion workflows across all systems, databases, and backup copies.
Mid-sized companies and SMEs need a lean but complete baseline: maintained records of processing, reviewed contracts with service providers, clear procedures for access requests and data breaches, and trained employees. Enterprises need uniform data protection governance across many entities and countries: clear roles between group privacy, data protection officers and local coordinators, intra-group data flows and third-country transfers with standard contractual clauses, one central record, and uniform breach procedures that meet the 72-hour notification deadline under Art. 33.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
Book Strategy Session30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance