GDPR Readiness

A GDPR readiness assessment is a structured review that evaluates your organisation's data protection maturity. It covers all GDPR-relevant areas: records of processing activities, technical and organisational measures, data protection governance, data subject rights, and processor management. The result is a clear overview of your compliance status with concrete recommendations.

The assessment follows four phases: first, stocktake through interviews and document analysis; second, technical review of systems and data flows; third, maturity scoring on a five-level model (Initial, Defined, Implemented, Managed, Optimised); fourth, creation of a prioritised implementation roadmap with concrete measures, timeline, and responsibilities.

Maturity is scored on a five-level scale: Initial (few documented processes), Defined (first measures in place), Implemented (formalised processes with clear responsibilities), Managed (monitored through KPIs), and Optimised (continuous improvement cycle). Each GDPR area receives its own score. The overall maturity level shows the compliance status and serves as the basis for prioritising measures.

Costs depend on company size and complexity: for SMEs they range from EUR 3,

000 to 8,000, for mid-sized companies from EUR 8,

000 to 20,000, and for large enterprises from EUR 20,

000 upward. Compared to potential fines of up to EUR

20 million or 4% of annual turnover, the investment is modest and provides clarity on what action is needed.

Duration depends on company size. For SMEs, expect two to four weeks; for mid-sized companies, four to eight weeks; for large enterprises, eight to twelve weeks. An initial call to estimate scope is free and non-binding.

A data protection audit checks compliance with existing requirements at a point in time. A readiness assessment goes further: it evaluates maturity, identifies structural gaps, and delivers a forward-looking roadmap. While the audit documents the current state, the assessment shows the path to your target compliance level.

After the assessment, identified gaps are prioritised and an implementation plan is created. Resources are allocated and remediation begins. Regular reviews track progress. A follow-up assessment after six to twelve months measures the improvement achieved and adjusts the roadmap as needed.