Full Cycle Privacy Compliance
In most jurisdictions, a completed project goes through three stages: two main stages and a third stage, with the third stage being optional but of great importance during the implementation process.
The first item a company requires is a register of personal data processing processes or a Record of Processing Activities (ROPA). To create this record, we conduct an interview, take a survey, review documentation, and study the IT architecture.
Compliance during this step results in a record that can be used to generate a list of documents and requirements to be implemented during the next phase.
At the end of this stage, the company receives between 12 and 35 documents describing processes to be implemented, adjustments to user journeys, recommendations regarding cross-border transfers and data localization, marketing adjustment advice, mandatory notifications/requests to supervisory authorities, and more.
During this stage, we perform everything that is required by the applicable law assessments and procedures, such as a Data Protection Impact Assessment (DPIA), a Legitimate Interest Assessment (LIA), and a general Privacy Impact Assessment (PIA).
Subsequent control in the form of an opinion on the compliance of the requirements applicable to the processing of personal data after the implementation of the requirements and documents.