Experience Map

WORLDWIDE

Privacy Project Scope

Highlight Type of compliance

Highlight Domains

Business processes

Interaction

Front

Backend

Legal

Product compliance

Full compliance

Full compliance

Full compliance with GDPR requirements is not just a matter of meeting external indicators.

Achieving full compliance requires a comprehensive approach that addresses all levels and components of your organization, including:

• The frontend, which is what the client sees
• The backend, which is what is hidden from the client but determines whether or not the basic requirements are met
• Legally significant texts and documents, both internal and external
• Business processes that permeate your organization and ensure effective internal and external compliance throughout your entire organization
• External interactions, their technical implementation, and legal structure

You can read more about each of these elements separately by clicking on the infographic.

In many cases, companies are not yet ready for a full compliance project for various reasons. However, if a company is preparing to launch or has already launched a product that involves processing personal data, it is rational to address the aspects of processing related to that product first. In the case of product compliance, we work on:

• The frontend of the specific product
  
  

• The backend of the specific product
  
  

• Legally significant texts and documents for the specific product
  
  

• Business processes that allow the product to be launched, including the process of responding to requests for the implementation of personal data subjects' rights
  
  

• External interactions related to the product, such as exchanging data with third-party services and partners.
  

This section includes not only the Privacy Policy, which contrary to popular belief is not the only necessary document. In addition, this aspect of GDPR compliance can be attributed not only to local regulatory acts, but also to important texts, such as the consent text or Privacy Notice (which may not be expressed only in the form of text).

These documents are necessary primarily to create conditions for the lawful processing of personal data and to ensure compliance with principles, such as transparency, fairness and lawfulness, as well as the principle of accountability. The principle of accountability requires organizations to be ready at any time to demonstrate compliance with GDPR through documents.

Legal

Contrary to common belief, backend is important not only in the context of ensuring security. Even with the most secure data storage in the world, it is possible to be non-compliant with GDPR.

This aspect of GDPR involves the location of databases, their interrelation, channels for transmitting personal data, storage, synchronization, and so on. Backend largely enables compliance with the principles of minimizing personal data by implementing mechanisms for deleting personal data, anonymizing personal data at the appropriate time in relation to certain personal data.

Everything that the user sees matters. The form, manner, and order of information provision, as well as the logic of the user path, are directly related to compliance with the principles of lawfulness, fairness, and transparency, as well as other principles.

The development of correct interfaces for digital products also affects the fulfillment of the rights of personal data subjects, or may hinder it, which leads to non-compliance with GDPR requirements.

Frontend

It is extremely rare that a data controller has all the necessary resources, uses no services, and only employees have access to personal data. In the vast majority of cases, the controller uses a large number of services, from email and mailing services to CRM systems or no-code services.

Each such interaction requires an analysis of integration and the establishment of correct contractual relationships. And in some cases, conducting and documenting a range of internal procedures, adjusting integrations.

Some provisions of GDPR require maintaining a certain type of business activity within the organization, such as conducting compliance assessments, updating the Register of processing activities, responding to requests from data subjects and supervisory authorities, responding to personal data security breaches, and others.

All of this requires coordinated work within the organization. New business processes need to be designed to fit into current business processes.