The difference between believing you are compliant and being able to show it.

01Who it is for

Organisations with a GDPR programme in place that has not been independently tested; groups whose Portuguese entity sits inside a wider compliance framework; businesses preparing for due diligence, certification or a regulatory interaction.

02The problem

“We believe we are compliant. We cannot demonstrate it, and accountability requires demonstration.”

03Scope

Legal review of processing activities, lawful bases, records, notices, retention, transfers, processor arrangements, data subject rights handling, breach procedures and governance, against the GDPR and Portuguese implementing law.

04Method

Documentary reviewRecords, policies, notices, contracts and the governance structure as they actually exist.
Structured interviewsWith business, IT and security — because the documents and the practice diverge.
Sampling of live processesA rights request, a transfer, a retention rule, followed end to end.
Gap analysisAgainst a defined framework, with findings ranked by legal risk rather than by ease of fixing.
ReportingTo management or board, in terms that support a decision.

05Deliverables

Findings report with legal analysis
Prioritised remediation plan
Register of outstanding decisions
Board-level summary

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.