Compliance Services
GDPR Assessments for Organizations Serving European Markets
Understand your data flows, identify gaps against the requirements relevant to your organization, and plan remediation. Our GDPR assessments help document the work needed for your cross-border privacy program.
What Is GDPR Compliance?
The General Data Protection Regulation (GDPR) governs processing of personal data within its material and territorial scope. It can apply through an EU establishment or to certain activities outside the EU that offer goods or services to people in the EU or monitor their behavior there. A person's citizenship, or merely holding data about an EU resident, does not by itself determine applicability.
Applicable obligations depend on the processing activity and the organization's role. They can include documenting processing, supporting individual rights, applying appropriate safeguards, assessing high-risk processing, and addressing international transfers. A scoped assessment should identify which requirements apply and the evidence needed to support them.
Start with the relevant legal entities, controller and processor roles, processing activities, and international data flows. The assessment scope should explain which requirements are being assessed and what the resulting deliverable does and does not establish.
What's Included
Comprehensive GDPR Assessment
Data Mapping & Inventory
Complete inventory of personal data processing activities, data flows, third-party transfers, and legal bases for processing.
DPIA Facilitation
Data Protection Impact Assessments for high-risk processing activities, with risk mitigation strategies and documentation.
Gap Analysis Report
Assessment of the GDPR requirements relevant to the agreed processing activities and organizational role, with findings and prioritized remediation recommendations.
Cross-Border Transfer Review
Assessment of international data transfer mechanisms — SCCs, adequacy decisions, and binding corporate rules for EU-US data flows.
Data Subject Rights
Review of your processes for handling access, rectification, erasure, portability, and objection requests within GDPR timelines.
Privacy by Design Review
Assessment of how data protection principles are embedded into your product development lifecycle and system architecture.
Our Process
Your Path to GDPR Readiness
Data Discovery
Map all personal data processing activities, identify data controllers and processors, and document legal bases.
Assessment
Evaluate current practices against GDPR requirements, conduct DPIAs for high-risk activities, and review policies.
Remediation
Implement recommended changes — update privacy notices, establish DSAR workflows, and strengthen technical measures.
Assessment Findings
Document the agreed scope, assessment findings, and remediation priorities. Any follow-up review or assurance deliverable is defined separately in the engagement terms.
A private GDPR assessment is not regulatory approval. GDPR certification under Articles 42 and 43 uses a separate approved mechanism; do not treat an assessment report as that certification.
Frequently Asked Questions
What is GDPR?
The GDPR is an EU data protection law governing personal-data processing within its scope. Its requirements depend on the activity and the organization's role. Territorial scope is assessed under Article 3, including establishment in the EU and certain activities involving people in the EU.
Does GDPR apply to US companies?
It can. Assess the relevant processing activities under GDPR Article 3. A US company may be subject through an EU establishment or through offering goods or services to people in the EU or monitoring their behavior there. A processor may also have contractual duties to an EU customer even when that fact alone does not place it directly within Article 3.
What is a Data Protection Impact Assessment (DPIA)?
A Data Protection Impact Assessment evaluates processing likely to create a high risk to individuals' rights and freedoms. Whether one is required depends on the activity, GDPR Article 35, and the relevant supervisory authority's guidance. It is not automatically required for every organization or every processing activity.
Get Started
Navigate GDPR with Transatlantic Expertise
Our Swiss-based team and US audit credentials provide the cross-border expertise your GDPR program needs.