GDPR · data protection · DPO

GDPR compliance for SMEs — with an external DPO, a record of processing, technical measures and a breach process

We support you with the record of processing activities, processor contracts, the documentation of technical and organisational measures, impact assessments, data subject requests and breach processes — structured, pragmatic and with clear responsibilities.

  • External DPO from 300 €/month
  • Record of processing, technical measures and processor contracts built up systematically
  • Breach process for the 72-hour reporting duty
  • GDPR audit and action plan
  • 30 minutes assessment
Book a free appointment Send a short enquiry
notivia since 2003· +50 ISMS clients*· +20 Full-service projects*· External DPO from 300 €/month· ★★★★★5.0

* Audit success relates to completed full-service certification projects since 2019.

Quick check

This page is for you if …

  • … you want to prepare for personal data .
  • … you need a a record of processing activities .
  • … you have to appoint a data protection officer (DPO) .
  • … you want to be ready for subject access requests or a data breach .
  • … you want to know what GDPR compliance costs and how long it takes.
Our services for the GDPR

Four building blocks. One route to compliance.

Every building block for GDPR compliance that stands up to scrutiny — the project, an external DPO, the audit and the templates, all from one source.

Maximum support

Full-service support

A GDPR implementation project — from the record of processing to the processor contracts, from the technical measures to the data protection concept.

This suits you if you want GDPR compliance with as little internal project load as possible.
  • Record of processing activities (Art. 30)
  • Documentation of technical and organisational measures
  • A set of processor contracts with clients and providers
  • Data protection concept & policies
from €3,500 one-off · M from 6,900 € · L from 11,500 €
Request a quote
Ongoing

External data protection officer (DPO)

We establish whether you need a DPO — in Germany often from 20 people working regularly with automated processing. We provide the external DPO and support implementation, review and evidence.

This suits you if you need an external data protection officer.
  • Appointment & notification to the supervisory authority
  • A data protection hotline for staff
  • An annual audit including the report
  • Handling data subject requests
from €300 / month
Enquire about consulting
12-month minimum term · 3 months' notice
One-off / yearly

Internal audit

A data protection audit against the GDPR requirements.

This suits you if you want your GDPR maturity verified before an authority ever looks at it.
  • A compliance check per department
  • Testing whether the technical measures work
  • Maturity score
  • A prioritised list of measures
from €2,900 one-off
Enquire about an audit
Self-service

Build it yourself

Build GDPR compliance yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for the GDPR

Standard-specific extras — bookable individually

DPIA (data protection impact assessment)

Structured to Art. 35 GDPR — for high-risk processing.

from €2,490

Data breach hotline, 24h

Support with the 24/72-hour reporting duty under Art. 33/34.

from €149/mo

Processor contract review

A review of your existing processor contracts.

from €890
DPO and data protection retainers: 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

A GDPR check in 30 minutes

Where you stand, what is missing, what comes next — an honest read on your GDPR compliance, without obligation.

Lead consultant
Lead consultant
Your contact
  • A quick answer
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·A quick answer·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free GDPR check · 3 min

    How GDPR-ready is your company?

    10 questions on records of processing, processor agreements, technical and organisational measures, access requests and training. Rate your maturity in 3 minutes.

    Start the check

    Or do it yourself

    The ISMS platform with its GDPR module

    The multi-standard ISMS digitalises the record of processing, processor contracts, the technical measures and the breach workflow — made for internal teams that want to document the GDPR requirements in a structured way.

    Explore the platform
    Guide · PDF

    GDPR guide for mid-sized companies

    What the regulation requires, which documents you need, what to do after a data breach — explained plainly.

    Download the guide
    The regulation in brief

    What has to be in place for the ISO 27001?

    Eight building blocks — the mandatory set for GDPR compliance.

    1. Record of processing activities (Art. 30)
    2. Processor­ contracts (Art. 28)
    3. Technical and organisational measures (Art. 32)
    4. Data protection impact assessment (Art. 35)
    5. 72-hour breach reporting (Art. 33/34)
    6. Rights of access and erasure (Art. 15–22)
    7. Staff training & awareness
    8. Data protection officer (Art. 37)

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    7 PRINCIPLES

    The core principles of the GDPR

    Art. 5 GDPR sets out seven principles that apply to every processing of personal data.

    Lawfulness

    Every processing operation needs a legal basis (consent, contract, legitimate interest and so on).

    Purpose limitation

    Data may only be collected for specified, explicit and legitimate purposes.

    Data minimisation

    Collect only the data actually needed for the purpose in question.

    Accuracy

    Personal data must be accurate and kept up to date.

    Storage limitation

    Keep data only as long as the purpose of processing requires.

    Integrity & confidentiality

    Appropriate technical and organisational measures to protect the data.

    Accountability

    The controller must be able to demonstrate compliance with all the principles.

    DATA SUBJECT RIGHTS

    The rights of data subjects

    The GDPR gives data subjects extensive control over their personal data.

    Access

    Art. 15 — the right to be told what data is held

    Rectification

    Art. 16 — the right to have inaccurate data corrected

    Erasure

    Art. 17 — the „right to be forgotten“

    Restriction

    Art. 18 — restriction of processing

    Portability

    Art. 20 — receiving the data in a machine-readable format

    Objection

    Art. 21 — objecting to certain processing

    No profiling

    Art. 22 — protection from automated decisions

    Information

    Art. 13/14 — the duty to inform when data is collected

    CORE REQUIREMENTS

    What the GDPR asks of you

    The main organisational and technical duties

    Record of processing activities (Art. 30)

    A complete record of every processing activity with its purpose, legal basis, categories and retention periods.

    Data protection impact assessment (Art. 35)

    A risk analysis for processing that poses a high risk to the rights and freedoms of natural persons.

    Data protection officer (Art. 37–39)

    Appointing a DPO for systematic monitoring, processing of special categories, or in public bodies.

    Breach reporting duty (Art. 33/34)

    Notification to the supervisory authority within 72 hours. Notification of the data subjects where the risk is high.

    Processing on behalf of a controller (Art. 28)

    Contractual arrangements with every provider that processes personal data on your behalf.

    Technical & organisational measures (Art. 32)

    Encryption, pseudonymisation, access control, resilience of systems, regular testing.

    Third-country transfers (Art. 44–49)

    Specific safeguards for transfers outside the EEA: SCCs, an adequacy decision, BCRs.

    Privacy by design & by default (Art. 25)

    Considering data protection when systems are designed, and choosing privacy-friendly defaults.

    Up to €20 million / 4 %

    For serious breaches (the principles, data subject rights, third-country transfers): up to €20 million or 4 % of worldwide annual turnover.

    Up to €10 million / 2 %

    For organisational breaches (the record of processing, the DPO, reporting duties): up to €10 million or 2 % of annual turnover.

    OVERLAP

    ISO 27001 as the a strong basis for the GDPR

    ISO 27001 is a strong basis for the GDPR — but it does not replace data protection compliance. Many building blocks such as risk management, access control, supplier management, incident management, business continuity and internal audits can be used for the technical and organisational measures under Art. 32 GDPR. The GDPR adds specific requirements such as the record of processing, processor contracts, data subject rights, impact assessments, legal bases, information duties and the DPO. Depending on scope and what you already have, ISO 27001 building blocks can prepare around 40–60 % of the technical and organisational GDPR evidence.

    GDPR requirementCovered by ISO 27001
    Art. 32 technical measures ISO 27001 Annex A (93 controls)
    Art. 35 impact assessment / risk assessment ISO 27001 cl. 6.1 risk management
    Art. 33/34 reporting duties ISO 27001 A.5.24–A.5.28
    Art. 28 processing on behalf ISO 27001 A.5.19–A.5.23
    Art. 25 privacy by design ISO 27001 A.8.25–A.8.31
    Art. 5(2) accountability ISO 27001 cl. 7.5 + cl. 9 documentation
    40–60 %
    of the technical and organisational GDPR evidence prepared by ISO 27001 — depending on scope and implementation
    OUR SOLUTION

    Implementing the GDPR with iso-easy

    1

    Take stock

    Recording every processing activity, checking the legal bases and assessing the risks.

    2

    Gap analysis

    Comparing your existing measures against the GDPR requirements and identifying what needs doing.

    3

    Put the measures in place

    Implementing the technical measures, setting up the processes, producing the documentation and training staff.

    4

    Compliant for the long run

    Ongoing monitoring, regular audits and continual improvement in a PDCA cycle.

    Record of processing Impact assessment templates Processor contract management Data subject rights workflow Documentation of technical and organisational measures Breach notification

    Or do it yourself

    The ISMS platform for the GDPR — and 10 further standards

    Digitalise the record of processing, the technical measures, data subject rights and impact assessments in a multi-standard ISMS — made for teams with internal resources that want to maintain all of it digitally.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    FAQ

    Frequently asked questions about the GDPR

    Who does the GDPR apply to?
    To every company that processes personal data of people in the EEA — whatever its location or size. In practice that is every company: customer data, staff data, website visitors, newsletter recipients and so on.
    Do I need a data protection officer?
    In Germany yes, if at least 20 people are regularly engaged in the automated processing of personal data, or if special categories of data are processed, or in public bodies. National thresholds vary across the EU.
    What is a record of processing activities?
    A central document listing every processing activity: what data is processed for what purpose on what legal basis, who has access, how long it is kept and which technical measures apply. It is the foundation of any GDPR compliance.
    What must I do when there is a data breach?
    Inform the competent supervisory authority within 72 hours (Art. 33). Where there is a high risk to the people affected, they must be notified without delay as well (Art. 34). Document every incident — even when there is no duty to report it.
    Does ISO 27001 help with GDPR compliance?
    Very much so. ISO 27001 covers around 65 % of the GDPR requirements — above all the technical and organisational measures (Art. 32). The data-protection-specific parts (the record of processing, data subject rights, impact assessments) have to be added. Together they make a strong compliance foundation.
    Can I implement the GDPR and ISO 27001 together?
    Yes, and we recommend it. Our multi-standard ISMS brings data protection and information security into one system. You build the ISMS once and thereby satisfy the GDPR's technical measures and the ISO 27001 requirements — without doing the work twice.
    How much internal work does this really mean for us?
    Setting the GDPR up from scratch the conventional way swallows 30–50 person-days of internal time (building the record of processing, reviewing processor contracts, documenting the technical measures, training). With our approach plus the ISMS platform we bring that down to 10–20 person-days — because we set up most of the record, the contract models and the templates for the technical measures for you.
    Do we need a data protection officer?
    Yes, if you are a public authority , or if your core activity is the large-scale regular processing of personal data (tracking or profiling, for example), or if you process special categories of data (health, religion and so on). In Germany additionally: from 20 staff working regularly with personal data in automated form. We are glad to take on the role as your external DPO from €300/month.
    What happens when there is a data breach?
    You have 72 hours from becoming aware of it to inform the supervisory authority (Art. 33). Where the risk to data subjects is high, all of them must be informed (Art. 34). Our ISMS platform gives you a prepared breach workflow including the notification template and the risk assessment — which takes a lot of the deadline risk away.
    How high are the penalties for breaching the GDPR?
    Depending on the breach the GDPR provides for fines of up to 10 million € or 2 % or up to 20 million € or 4 % of worldwide annual turnover (Art. 83 GDPR). What matters is the nature, gravity and duration of the breach, the degree of negligence and the measures taken.
    Is ISO 27001 enough for the GDPR?
    ISO 27001 covers around 40–50 % of the GDPR requirements (the technical measures, security, risk management). But the GDPR adds specific requirements such as the record of processing, processor contracts, rights of access, breach reporting and the DPO duty — depending on scope and what you already have.