02 / Compliance and certification
GDPR, where the paperwork meets the servers
We help you check that what your records say about personal data is what your systems actually do with it, and that the security around it would hold up to a question from a supervisory authority.
Overview
What the GDPR asks of you
The General Data Protection Regulation, Regulation (EU) 2016/679, applies to anyone who processes personal data of people in the EU in the course of offering them goods or services, or monitoring them, and to everyone established in the EU. It asks you to know what you process and why, to protect it with appropriate technical and organisational measures, and to be able to prove both.
Much of that proof is documentation: records of processing activities, data protection impact assessments where processing is likely to be high risk, contracts with processors, and a way to handle breaches and requests from data subjects. Much of the risk is technical. We look at both and at whether they match.
Black Fox does not give legal advice and is not your data protection officer. Questions about lawful bases, transfers or the reading of the text belong with your counsel or your DPO. We work alongside them on the security and the evidence.
Who it is for
Organisations of any size that handle personal data of customers, staff or users in the EU, and processors who need to show their clients that they are a safe pair of hands. Also teams preparing for an audit by a client or by the official auditors.
The work, from scoping to evidence.
What we do
Records of processing
We help you build or review your records of processing activities, so they describe the systems, recipients and retention you really have, not the ones you had three reorganisations ago.
Data protection impact assessments
Support with DPIAs for processing likely to result in a high risk: describing the processing, assessing the risks to people and choosing the measures that reduce them.
Security of processing
A review of the technical and organisational measures around personal data, such as access control, encryption, logging, backups and testing, checked on the systems themselves.
Processors and contracts
A review of your processors and sub-processors, the agreements you have with them, and whether their security matches what the contract promises.
Breach handling
A procedure to detect, assess, record and notify personal data breaches, with an exercise to see whether it works on a bad day.
Data subject requests
A workable process for access, rectification, erasure and the other rights, including how you find a person's data across systems.
How the engagement runs
Kickoff
We agree the scope, the people involved and who your counsel or DPO is, and sign an NDA first if you need one.
Discovery
Interviews, document review and a look at the systems where personal data actually lives.
Gap assessment
A comparison of your documentation and your controls with the regulation's requirements, ending in a ranked list of gaps.
Remediation support
We work with your owners on records, DPIAs, processor agreements, security measures and the breach and request processes.
Testing
Optional technical testing of the systems that hold the most sensitive data, with proofs of concept for what we find.
Handover
Recommendations, a business report with the risk assessment and a technical report, then a closing meeting for your feedback.
What you receive
- GDPR gap assessment with a prioritised action plan
- Reviewed or new records of processing activities
- DPIA support and completed assessments where needed
- Security of processing review with technical findings
- Processor review and contract checklist
- Breach handling and data subject request procedures
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Can you be our DPO?
Not as part of this service. We work with your DPO, or with whoever handles data protection for you, on the security and the documentation. If you need a DPO or legal advice, that sits with a specialist or your counsel.
How quickly must we report a breach?
A controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people. Where the risk is high, the people affected must be told as well.
Is there a GDPR certification?
The regulation allows for approved certification mechanisms, but they are not the usual route and there is no single GDPR certificate. Our certificate of successful engagement records that an engagement took place. It is not a compliance certification.
Do we need a DPIA?
When processing is likely to result in a high risk to people, for example large-scale processing of sensitive data or systematic monitoring. Supervisory authorities publish lists of processing that needs one. We help you decide and, where needed, carry it out.
Related services
- Compliance and certificationISO/IEC 27701ISO/IEC 27701 support from Black Fox Security: PIMS scoping, controller and processor roles, privacy risk, records of processing and certification preparation.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
- Governance and riskThird-party risk managementSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.
- Advisory and responseDigital forensics and incident responseDFIR from Black Fox Security: incident post-mortems, network and storage forensics, reverse engineering, data recovery, response plans and tabletop exercises.
Check what your records promise
Tell us what personal data you handle and where it lives. We will compare it with what the regulation and your documents say.