A full audit of personal-data processing, a risk map and a documentation package to demonstrate GDPR and ISO 27701 conformity to regulators and auditors - ahead of turnover-based fines and enforcement action.
4-6 weeks
Audit and documents timeframe
8-12 docs
Policy package for approval
4 stages
From diagnostics to control
02Data classification (protection levels)
G-INVEST
Data Protection Compliance
Document package
Records of processing activities
Data classification (protection levels)
Technical security controls
Encryption and cryptographic protection
Internal acts and consents
Regulatory liability
What you get
What we close under GDPR
The scope of measures depends on the protection level. Client details under NDA.
up to $20Mfine for a data breach (GDPR)up to 4%of global annual turnover72 hoursbreach notification window
01 / 07Regulatorwhat to file and show to the data protection authority
Records of processing and regulator filings
In short
A company that processes personal data must be able to show what it processes, why, where and for how long - in records of processing activities, and in the regulator notifications or registrations its jurisdiction requires. We compare what is on record with what the company actually does and prepare new records or updates.
There are no records, they were made long ago, or they do not reflect new purposes, systems, transfers to contractors or abroad.
Company details, processing purposes and data categories, where servers and databases are located, who receives the data.
Whether the purposes, categories of data subjects, storage locations and retention periods on record match the actual processing, and whether there are cross-border transfers that need separate safeguards.
Records of processing activities and, where required, regulator filings prepared for submission.
About the service
A full audit of personal-data processing and a prioritised gap map (critical / high / medium / low)
A package of 8-12 internal policy documents ready for approval by the head of the company
Preparation of records of processing activities and an implementation roadmap aligned with GDPR and ISO 27701
What we need to start
A list of systems that hold customer and employee data: website, CRM, accounting, cloud
Current policy, consents and regulator filings, if any
A list of contractors who receive data
A contact for the person in charge of IT
Close your data-protection regulatory risk with a single package4-6 weeks audit and documents timeframe8-12 docs policy package for approval
what to file and show to the data protection authority
A company that processes personal data must be able to show what it processes, why, where and for how long - in records of processing activities, and in the regulator notifications or registrations its jurisdiction requires. We compare what is on record with what the company actually does and prepare new records or updates.
Regulator02 / 07
Internal policies and consents
what to file and show to the data protection authority
The data processing policy, internal regulations, orders and consent forms - the first things an inspector asks for. We write them for the company's real processes, not from an internet template.
Information systems03 / 07
Information system classification
where the data is stored and how it is protected
We identify which systems hold personal data - website, CRM, accounting system, cloud services, CCTV - and set a protection level for each. The level determines which security measures are mandatory.
Information systems04 / 07
Technical security controls
where the data is stored and how it is protected
For each protection level we select the required set of controls: access management, media tracking, backup, malware protection, logging. We record what is already in place and what needs to be implemented.
Information systems05 / 07
Encryption and cryptographic protection
where the data is stored and how it is protected
If data is transmitted over open channels or stored with an external provider, encryption may be required. We determine whether you need it and to what standard.
Liability06 / 07
Incidents and liability
what happens if the data leaks
Data breaches carry turnover-based fines - under GDPR up to 4% of global annual turnover - and regulators expect breaches to be reported within 72 hours. We build procedures that reduce the risk and show the regulator the company acts in good faith.
Implementation and control07 / 07
Implementation and control
We approve the documents, appoint the person responsible for data processing, train staff and check that the website, CRM and HR records work the way the policy says.
A package of internal policies for approvalResult
What you get
A map of personal data processing and gaps, with priorities, Policy, regulations, orders and consent forms, Records of processing and regulator filings where required, Classification record, threat model and list of security measures, Data processing agreements for contractors, Implementation roadmap
01 / 07
About the service
A full audit of personal-data processing and a prioritised gap map (critical / high / medium / low)
A package of 8-12 internal policy documents ready for approval by the head of the company
Preparation of records of processing activities and an implementation roadmap aligned with GDPR and ISO 27701
Close your data-protection regulatory risk with a single package
4-6 weeks audit and documents timeframe8-12 docs policy package for approval
A list of systems that hold customer and employee data: website, CRM, accounting, cloud
Current policy, consents and regulator filings, if any
Open a card to see the task, the work and the result.
How we work
01
DiagnosticsInventory of personal-data systems, interviews, data-flow mapping, register of processes - weeks 1-2
02
Gap analysis and documentsReview against GDPR, ISO 27701 and ISO 27001 technical security controls, the policy package and records of processing - weeks 3-6
03
Implementation and controlApproval of policies, appointment of a data protection officer, staff training, support during regulatory and audit inspections
Who it suits
The service is needed by any data controller or processor - that is, almost any company that collects data of clients, employees or users.
Online stores and services that collect client and user data
Retail banking, fintech and medical IT services handling sensitive data
Companies with an outdated policy and pre-ticked default consents
Businesses that have not maintained, or maintained incompletely, their records of processing activities
Cost
01
Fixed price with no hourly rate; the estimate is set after the express diagnostics
02
Entry pointExpress personal-data diagnostics; the full audit is priced by the scope of personal-data systems
03
Support and control of regulatory and audit inspections - on a retainer basis
Practice lead
Marina BorisyukGeneral Partner · Auditor
Managed a multi-million development organization for 15 years. M&A expert.
EducationMBA RANEPA, Moscow Engineering Physics Institute, CA.
Why G-Invest
We close the data-protection regulatory risk with a single document package.
G-Invest in numbers
23+Years of asset management
$15MManaged by the company
$78MRealized projects volume
650+Projects implemented
01Fixed costA fixed price with no hourly rate and no hidden lines; the exact estimate is set after the express diagnostics.
02Artifacts, not wordsA concrete document package, ready to present to regulators and auditors on inspection day.
03A single point of accountabilityThe project is led by a senior auditor - from diagnostics to representation before regulators and auditors.
04Full coverage of requirementsWe close all mandatory data protection requirements: policy, consents, data-processing agreements with processors, data classification and records of processing aligned with GDPR and ISO 27701.
Let's discuss your taskClose your data-protection regulatory risk with a single package
Start with express diagnostics - we will map the processing scope and fix an exact estimate for the full audit.
Not sure which format you need? Answer 2 questions and we'll suggest a solution.
Any data controller or processor. If a company collects data of clients, employees or users, it must comply with applicable data protection regulations such as GDPR, maintain records of processing activities and appoint an officer responsible for organising personal-data processing.
Under GDPR the maximum fine for a serious violation is up to $20 mln or 4% of global annual turnover, whichever is higher. Regulators may also order processing to stop and impose reputational and contractual consequences. Personal-data breaches must be notified to the supervisory authority, in many regimes within 72 hours of becoming aware of the incident.
The audit and preparation of the document package take 4-6 weeks: weeks 1-2 - diagnostics, 3-4 - gap analysis and risks, 5-6 - documents and records of processing. The exact schedule is fixed after the express diagnostics.
8-12 internal policy documents: the personal-data processing policy, a regulation, procedures, instructions, records of processing activities, consent templates, a data classification act with assigned protection levels and prepared records of processing aligned with GDPR and ISO 27701.
Yes. We prepare or update the records of processing activities and help appoint the officer responsible for organising processing. Preparing these records is part of the full audit.
Yes. Support is available on a retainer basis: updating the policies, monitoring compliance and supporting regulatory and audit inspections, including the procedure for notifying of incidents within 72 hours.
Other servicesFull-cycle legal and financial solutions
