Plan around actual data processing
A privacy notice alone does not establish actual processing practice. Connect processes, records and responsibility. Describe your organization and question without diagnosing the applicable law yourself.
Clarify purpose and responsibility
Is this an initial review, records, new systems, individual rights or an incident? Businesses, public bodies and personal enquiries differ. International connections require specific assessment.
Map data flows clearly
Describe purposes and affected groups without including personal data in the request. Access, sharing and deletion are part of the process. Resolve gaps through targeted follow-up.
| Area | Useful description |
|---|---|
| Data / purpose | Customers, staff, website or other processing. |
| Systems / recipients | Tools, external providers, access and countries. |
| Organization | Ownership, retention, deletion and enquiries. |
Assess outsourcing and foreign connections
Outsourcing does not automatically transfer responsibility. Assess instructions, subprocessors, security and support for rights requests. Processing locations and remote access matter alongside the contracting party’s address. Contracts need to match practice.
Assess incidents promptly
A possible incident needs professional assessment of facts, protective action and possible notification duties. Describe observed status without sensitive details. This quote request is not a regulatory notification, deadline extension or promised immediate emergency response.
Agree deliverables and effort
Compare scope and internal work rather than package names. Legal review, technical delivery and ongoing support can be separate items. Measures need owners and maintenance to keep records current.
| Brief | Clarify the outcome |
|---|---|
| Assessment | Assessed scope, gaps and priorities. |
| Records | Align documents with actual practice. |
| Training / support | Participants, content, ownership and follow-up effort. |
Prepare for initial scoping
Exchange protected documents later through an agreed secure channel.
- Organization. Identify role, sector and international connections.
- Question. Describe affected processes and desired help.
- Stage. Identify records, systems and observed problems.
From assessment to supported implementation
A quote or template does not certify comprehensive compliance.
- Define. Clarify purpose, flows and specialist responsibility.
- Assess. Assess practice, records and prioritized measures.
- Implement. Agree ownership, handover and updates.
Frequently asked questions
Must I know the applicable law?
No. Describe the organization and connections; the specialist assesses applicability.
Is a privacy notice sufficient?
It must match practice; also assess organization, contracts and security.
Does the cloud provider take over responsibility?
Not automatically. Assess your duties, contracts, access and processing locations.
Is this request an incident notification?
No. Assess duties and required notification channels promptly with a specialist.
Is technical implementation included?
Only if agreed. Define consulting, legal review and IT work separately.
Can training be commissioned?
Yes. Identify actual participants and topics; agree content and follow-up.
