General Data Protection Regulation (GDPR)
An article-by-article review of your processing against Regulation (EU) 2016/679, scoped to your role as controller or processor, your processing activities and your establishment.
Privacy and data protection assessments
Article-by-article reviews of how you process personal data in the European Union, the United States, Canada and southern Africa.
A privacy law is a legal instrument before it is a security standard
Much of a privacy regulation is satisfied in a notice, a contract or a legal analysis, not in a system. In GDPR, 34 of the 99 articles are institutional, definitional or addressed to supervisory authorities and carry no technical evidence at all.
We name those provisions instead of quietly folding them in, and we concentrate technical evidence where the law actually asks for technical measures. Each review is scoped to your role, your processing activities and where you are established.
Privacy laws and frameworks we assess against
California Consumer Privacy Act (CCPA)
A compliance and risk assessment of your data handling practices against the CCPA, covering transparency, consumer rights and the data flows behind them.
NIST Privacy Framework v1.0
An outcome-by-outcome review of your data processing against the Privacy Framework Core: all 100 subcategories across 18 categories and 5 functions.
Personal Information Protection and Electronic Documents Act (PIPEDA)
A readiness and gap review against Part 1 and Schedule 1 of the Canadian act, covering the ten fair information principles and the mandatory breach of security safeguards provisions.
Protection of Personal Information Act (POPIA)
A readiness and gap review against the South African act, including the eight Conditions for Lawful Processing, direct marketing and automated decision making, and transborder information flows.
Zimbabwe Cyber and Data Protection Act (CDPA)
A readiness and gap review against the Data Protection Act [Chapter 11:22], scoped to your processing activities and your position as controller or processor.
Questions about Privacy and data protection
Is a privacy assessment legal advice?
No. We assess your processing against the text of the law and report where the evidence supports your position and where it does not. Legal determinations remain with your counsel, and we flag the provisions that need one.
We operate in several jurisdictions. Can you assess them together?
Yes. The laws overlap heavily in areas such as lawful basis, individual rights, security safeguards and breach notification, so evidence collected once is reused across the regimes in scope.
Do you cover financial privacy rules such as GLBA?
Yes. The GLBA Privacy Rule and the Fair Credit Reporting Act are part of our healthcare and financial services assessments.
Related AWS services
- Assessments and complianceAI assessments against the NIST AI RMF, ISO 42001 and the EU AI Act, plus SOC 2, FedRAMP, CMMC, HIPAA, PCI DSS and CIS AWS Benchmarks.
- Governance and securityLanding zones built on AWS Control Tower, Organizations and IAM Identity Center, with guardrails that hold.
- Databases on AWSMigrate Oracle, SQL Server, MySQL and PostgreSQL to Amazon RDS and Aurora, and cut licensing costs.
Talk to an AWS engineer about your environment
Book a consultation with our team in Salt Lake City, Bordeaux or Johannesburg and tell us what you are trying to solve.