GDPR Compliance

Implementation is technical and procedural, and does not constitute legal advice; where a lawful basis or a legal question must be decided, that decision stays with the client and their counsel. Work begins with a data map recording what personal data is collected, at which entry point, where it is stored, who it is shared with and how long it is kept, because none of the downstream controls can be built without it. A consent management platform is deployed that blocks non essential scripts until consent is granted rather than merely recording a preference afterwards, and consent is logged with timestamp, scope and version of the notice shown. Refusing is made as straightforward as accepting. Consent state is passed to analytics and advertising tags so they do not fire before it exists. Subject access, rectification, erasure and portability requests are given a defined workflow with an owner and a tracked deadline, and the systems holding personal data are enumerated so a request can actually be fulfilled across all of them. Retention periods are enforced by scheduled deletion rather than by intention. Processor agreements and transfer mechanisms are recorded for every third party receiving data.

Industry Insight