GDPR / DSGVO
GDPR compliance that holds up in a customer’s DPA review
EU customers send a data processing agreement and a TOMs questionnaire before they sign. We build the records, assessments and processes behind your answers, so they hold up when a customer or a supervisory authority asks for proof.
At a glance
TypeEU regulation, no certificate
Enforced byNational supervisory authorities
Best forCompanies processing EU personal data, as controller or processor
Typical first phaseDepends on how many systems hold personal data
Overview
What it is
The General Data Protection Regulation applies to any company that processes personal data of people in the EU, wherever the company is based. There is no GDPR certificate. You show compliance with the documents the regulation requires, such as records of processing (Art. 30), data protection impact assessments (Art. 35) and processor contracts (Art. 28), and with processes that work when tested: an access request answered within a month, a breach reported within 72 hours.
For B2B software companies the pressure usually comes from customers: their DPA, their questions about US transfers, their audit rights. In Germany the BDSG adds its own rules, including when you must appoint a data protection officer.
You need this if…
- An EU customer sent a DPA or TOMs questionnaire you can’t answer with confidence
- You transfer personal data to the US or rely on US subprocessors
- You are launching something that profiles users, handles health data or applies AI to personal data
- You have no record of processing activities, or it was written once and never updated
The Lightwork Method
How we get you there
01
Data mapping
Inventory systems, data categories, purposes and subprocessors from interviews and system exports.
02
Gap assessment
Score current practice against the GDPR and, where it applies, the BDSG.
03
Records and assessments
Build the Art. 30 records, DPIAs where Art. 35 is triggered, and transfer impact assessments.
04
Contracts and notices
Review your DPA, subprocessor list and privacy notices together with your counsel.
05
Working processes
Set up access request, deletion, retention, breach and vendor review procedures, then test them.
06
Keep it current
Quarterly review of new processing, new vendors and changed purposes.
Deliverables
What you walk away with
- Data map and record of processing activities (Art. 30)
- Gap report with prioritized actions
- DPIAs for high-risk processing
- Technical and organizational measures (TOMs)
- Access request and breach response procedures
- DPA and subprocessor register ready for customer review
Timeline & pricing
Pricing depends on how many systems and processing activities are in scope. Contact us for a fixed-price proposal.
A documented baseline for a single software product usually takes a few weeks to a few months, depending on how many systems hold personal data.
We will give you a realistic timeline after scoping.
Are you a law firm or a data protection officer?
No. We do the operational and technical work: data mapping, records, DPIAs, TOMs and processes. Legal interpretation and contract negotiation stay with your counsel, and we work alongside your data protection officer if you have one.
Does ISO 27001 make us GDPR compliant?
No, but it covers much of what Art. 32 asks for on security of processing, and ISO 27701 extends an ISMS to privacy. If you are building an ISMS anyway, we run both from one set of evidence.
Do we need a data protection officer?
Under Art. 37 you do if your core activities involve large-scale monitoring of people or large-scale processing of special categories of data. In Germany, § 38 BDSG also requires one once at least 20 people regularly process personal data by automated means.
How does the EU AI Act fit in?
An AI system that processes personal data still needs a lawful basis under the GDPR, and often a DPIA. The AI Act adds its own obligations on top. Our EU AI Act checker gives a first read.
Bring your privacy program into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.