When this service is useful
Compliance questions usually become urgent when someone outside the company asks about them. It is better to be ready beforehand:
- Your privacy policy is missing, outdated or does not reflect what the company actually does.
- You do not have an overview or register of personal-data processing activities.
- A client, partner or tender asks for evidence of ISO 27001 or information-security practices.
- NIS2 may apply to the company, but nobody has assessed whether or how.
- Documents exist, but people do not follow them and written policy no longer matches reality.
What the service includes
Current-state assessment
An honest view of where the company stands on data-protection and information-security requirements: what is in order, what is missing and what is most urgent.
GDPR documentation
A privacy policy, record of processing activities, contract appendices and procedures written around the way your company actually works.
Progress towards ISO 27001
Required policies, risk treatment and a control overview designed to support daily work rather than obstruct it.
Implementation support
A document without practice protects nobody. I help put the principles to work through training, practical reminders and technical settings.
Answers to external questionnaires
I help answer clients’, partners’ and tenders’ information-security and data-protection questions clearly and honestly.
How we work together
I begin by assessing what the company actually does with data and which requirements apply. We prepare the documentation together: it describes real working practices instead of copying a template, because only accurate documentation can stand up to an audit or incident. Finally, I help put the principles into practice so that policy and reality remain aligned.
Outcome: data-protection and information-security practices that meet requirements, reflect reality and can be sustained by the company.
Frequently asked questions
Do you prepare the documents, or do we have to write them?
I prepare the documents, working with you. Interviews and reviews ensure that they describe what the company actually does. A copied template that does not match reality is useless, or even harmful, during an audit or incident.
What is the difference between GDPR and ISO 27001?
GDPR is a European Union regulation protecting personal data and is mandatory for anyone who processes it. ISO/IEC 27001 is a voluntary information-security management standard with a broader scope. They complement each other: sound information security also makes GDPR compliance easier.
Is ISO 27001 certification affordable for a small company?
Certification is a separate decision and expense, worth considering when clients or the market require it. Applying ISO 27001 principles without formal certification often delivers much of the benefit at lower cost. I help assess which route makes sense in your situation.
Start with a short conversation
Tell me briefly what your company needs help with. I will reply personally and we can assess whether and how I can help.