A fine can reach 4% of turnover
GDPR is not a box to tick. Where an infringement is found, the fine can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher. Many small businesses discover this risk during an inspection or a customer request, because they never formalised their record of processing activities.
An inventory of existing personal data processing.
Drafting of the record of processing activities.
A draft privacy notice and information notices, prepared from the information you provide and the agreed scope.
Configuration of the cookie consent banner according to the rules on trackers and the guidance of the supervisory authorities.
Scope of the service: this support covers the technical and organisational side (record, documentation, configuration). It is not legal advice and does not replace a lawyer or a Data Protection Officer (DPO). We do not guarantee absolute legal compliance, which also depends on your internal practices and how they change over time. Sensitive or high-risk processing, a Data Protection Impact Assessment (DPIA), transfers outside the EU and complex situations need a specific analysis and, where necessary, a DPO or legal counsel.
Who is it for?
Businesses that have never formalised their GDPR compliance.
Businesses collecting customer or prospect data (CRM, web forms, marketing).
Businesses that want structured GDPR documentation and a clearer file in case of a request or an inspection.
The service is built on the EU General Data Protection Regulation. Outside the European Union, local law may differ (the UK GDPR, the Swiss revised Federal Act on Data Protection, and others): we tell you at the scoping stage what we can document and what calls for a local legal adviser.
Pricing by scope
The price depends on the number of processing activities and the documentation to produce. The starting price shown above covers simple support for an organisation with a limited number of processing activities (website, CRM, basic HR). Several processing activities or broader documentation are priced in a higher tier. Complex cases (several subsidiaries, many processors, sensitive processing) are priced on request.
How it works
Inventory: listing processing activities, tools, recipients and the information available.
Analysis: assessing the gaps against GDPR requirements.
Documentation: drafting the record, the draft policies and the notices.
Implementation: technical set-up (cookie banner, forms, opt-in).
Handover: presentation of the compliance file and recommendations.
The work is done remotely, through a questionnaire, video calls and shared documents.
Deliverables
Record of personal data processing activities.
Draft privacy notice and information notices.
Cookie banner configured according to the applicable rules and supervisory authority guidance.
A concise compliance file.
Recommendations to keep it up to date.
A handover meeting and one round of clarification on the delivered file, within the agreed scope.
Further reading
Frequently asked questions
My website has a cookie banner. Am I compliant? Not necessarily. A cookie banner only covers part of GDPR. The record of processing activities, the information notices and your internal processes matter just as much.
What is the risk of non-compliance? Fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher. Beyond the fine, your customers' trust is at stake.
Do we need to appoint a DPO? It is mandatory for some organisations (public bodies, large-scale processing of certain data). We can help you spot the signs that a DPO may be needed, but the final assessment lies with you, a DPO or specialist legal counsel.
Do you guarantee my legal compliance? No. We structure the technical and organisational side (record, documentation, cookie banner) according to GDPR good practice, but we are not lawyers and do not act as a DPO. For a guarantee or binding legal advice, a lawyer or DPO remains recommended, especially for sensitive or high-risk processing.
Which situations need a separate analysis or another adviser? Legal advice, legal validation of notices and complex contract drafting; any guarantee of compliance or the role and liability of a DPO; a full DPIA, sensitive or high-risk processing, complex transfers outside the EU; ongoing compliance management and handling of data subject requests over time; responding to a supervisory authority inspection or notifying a data breach on behalf of the controller. None of these are included in the base price.