What we do for your company

Compliance assessment

The assessment shows how far your company’s processing of personal data complies with Law No. 195/2024. The controller is responsible for compliance with the principles of processing and must be able to demonstrate it (art. 5(2) and art. 24(1)). You receive a written report of what is missing and the priorities for putting it right. You can order the assessment on its own, and it is also the first step of every package.

• ✓Online interviews with the people who know how the company processes data
• ✓Inventory of the personal data you process
• ✓Analysis of whether you must keep a record of processing activities
• ✓A written report of what is missing under Law No. 195/2024
• ✓Priorities for putting it right, starting with the highest risks

Compliance documentation

Compliance documentation brings together, as applicable, the documents through which your company applies Law No. 195/2024: the record of processing activities (art. 30), the information for data subjects (art. 13 and 14), data protection policies (art. 24), contracts with processors (art. 28), the security measures (art. 32) and the rules for those who work with the data only on the controller's instructions (art. 29). We prepare them on the basis of what your company actually does.

• ✓Data inventory and gap report
• ✓Records of processing activities, with the legal basis and retention period of each
• ✓Data protection policy and a description of the security measures
• ✓Privacy notices for each group of people: clients, employees, patients
• ✓Contracts with processors, new or reviewed
• ✓Internal rules for data subject requests and for personal data breaches
• ✓The confidentiality commitment and the written note for employees

External data protection officer

A data protection officer is mandatory for public authorities and bodies, except courts acting in the administration of justice, and for controllers whose core activities consist of regular and systematic monitoring of data subjects on a large scale or of large-scale processing of special categories of data or of data relating to criminal convictions (art. 37(1)), and also where other laws require one (art. 37(4)). In all other cases designation is voluntary. The officer may be external, under a service contract (art. 37(6)).

• ✓Informing and advising management and employees
• ✓Monitoring compliance with the Law and with internal policies
• ✓Advice on the data protection impact assessment
• ✓Cooperation with the National Centre for Personal Data Protection and acting as its contact point
• ✓Contact point for data subjects
• ✓Preparing the communication of the officer's contact details to the Centre and the text for publishing them

Employee briefing and advice

The controller and the processor take steps to ensure that any natural person acting under their authority who has access to personal data processes them only on instructions from the controller (art. 32(4)). Informing and advising the employees who carry out processing is also one of the data protection officer's tasks (art. 39(1)(a)). Where the company processes the national identification number (IDNP) on the basis of legitimate interest, the Law also requires regular instruction, on their obligations, of the people who process it under the company's authority (art. 53(2)(c)).

• ✓An online briefing session for up to 20 people
• ✓Explaining the company's documents and procedures with examples from its own activity
• ✓Answers to employees' questions
• ✓An attendance list, kept by the company

Breach response support

In the case of a personal data breach, the controller notifies the National Centre for Personal Data Protection without undue delay and, where possible, not later than 72 hours, unless the breach is unlikely to result in a risk (art. 33(1)). Where the risk is high, it informs the data subjects (art. 34(1)).

• ✓Assessment of the risk to the rights and freedoms of natural persons
• ✓Notification to the Centre, where required
• ✓Communication to data subjects, where the risk is high
• ✓Documentation of the breach, its effects and the remedial action taken