GDPR Compliance
GDPR is the law a lot of companies outside Europe assume doesn't apply to them, right up until they realize it covers anyone processing the personal data of people in the EU, regardless of where the company itself is based. It's also the law a lot of companies inside Europe have "complied with" in the sense of having a privacy policy, without having done the actual work underneath it — lawful basis for processing, data mapping, breach response readiness, and real mechanisms for honoring data subject rights.
Where the gap usually is
The most common thing I find isn't a missing policy — it's a disconnect between what the policy says and what the organization can actually demonstrate. A lawful basis listed for a type of processing that nobody can actually justify when you ask hard questions. A data subject access request process that exists on paper but has never been tested against a real request. A 72-hour breach notification requirement that nobody has a realistic plan to meet because detection and escalation would take longer than that on their own.
How I approach it
I start with data mapping that's grounded in reality — what personal data you collect, why, where it's stored, who it's shared with, and what the lawful basis actually is for each category of processing. From there, I help build out the mechanisms that make the rights in the regulation real: a working process for access, rectification, erasure, and portability requests that can meet the required timelines, and data processing agreements with vendors that actually reflect what those vendors do with the data.
I spend particular attention on breach response, because the 72-hour notification clock is unforgiving and most organizations haven't rehearsed it. We build a realistic incident response plan with GDPR notification obligations built in from the start, not bolted on afterward, and if it's warranted, work through whether a Data Protection Impact Assessment is needed for higher-risk processing activities.
Who this is for
Companies processing personal data of EU residents who've never done a real gap assessment against the regulation, organizations expanding into European markets, and anyone who's had a close call with a data subject request or a near-miss breach and realized their plan was mostly aspirational.
If you want a clear-eyed look at where your GDPR program actually stands, reach out.