GDPR Implementation Roadmap
A phased 12-month implementation programme — from initial data mapping through lawful basis documentation, consent management, privacy notice publication, rights procedures, vendor management, and ongoing accountability — aligned to practical delivery milestones.
Explore Resource
Data Mapping and Inventory
How to conduct a systematic data mapping exercise — identifying what personal data is collected, where it is stored, how it flows, who processes it, and for what purpose — producing the data inventory that underpins the RoPA, DPIA, and lawful basis documentation.
Explore Resource
Lawful Basis Assessment and Documentation
A structured methodology for assessing and documenting the lawful basis for each processing activity — including the legitimate interests assessment process, how to document decisions, and what happens when the basis needs to change.
Explore Resource
Consent Management
Building a consent management programme that satisfies GDPR’s consent conditions — freely given, specific, informed, unambiguous — with consent collection mechanisms, withdrawal processes, consent records, and the technical infrastructure for consent management at scale.
Explore Resource
Privacy Notices and Transparency
How to write privacy notices that satisfy Articles 13 and 14 transparency requirements — layered notices, just-in-time notices, mobile-first design, and the information that must be provided at the point of collection.
Explore Resource
Data Subject Rights Procedures
Building operational procedures for handling subject access requests, erasure, rectification, restriction, objection, and portability — from intake through fulfilment within statutory deadlines.
Explore Resource
Vendor and Processor Management
How to assess, contract, and manage processors — the mandatory Data Processing Agreement requirements, sub-processor management, the vendor assessment process for new procurement, and ongoing processor oversight.
Explore Resource
Cross-Border Data Transfers
The complete transfer mechanism toolkit — adequacy decisions, Standard Contractual Clauses, Transfer Impact Assessments, Binding Corporate Rules, and the mechanics of Chapter V compliance for organisations transferring personal data to non-EEA countries.
Explore Resource