Practice I — Corporate Strategy & Legal Architecture

Data Protection

Practice I · Service 02

GDPR audits, DPIA scaffolding, and architecture for cross-border data transfers.

NIS2 perimeter scoping. Records of processing. Vendor due-diligence framework. The discipline is structural — not advisory.

01

Overview

The European data-protection regime — GDPR (Regulation (EU) 2016/679) reinforced by NIS2, the Data Act, and Schrems II jurisprudence — is no longer a checklist. It is an operating constraint on architecture: data flows, vendor selection, third-country transfers, and incident response are all decisions made under the regulation, not against it.

Data Protection delivers the structural posture required to operate within this constraint defensibly. The mandate produces a current-state map of data flows, a remediation programme, transfer-mechanism architecture, and the documentation required for both supervisory inquiry and customer due-diligence. The output is permanent infrastructure, not a one-off audit memo.

02

Scope

The mandate components delivered under this engagement.

01

GDPR Maturity Assessment

Current-state assessment against the full GDPR obligation set, with a remediation roadmap calibrated to risk and timeline.

  • Article 30 records of processing — inventory and gap analysis
  • Lawful basis review per processing operation
  • Data subject rights operational readiness (Articles 15–22)
  • Article 32 security-of-processing assessment
  • Breach-notification readiness (72-hour clock)
  • DPO appointment and Article 37 reporting line review

02

Cross-border Transfer Architecture

Transfer-mechanism selection, design, and execution for data flowing outside the EEA.

  • Adequacy decision applicability under Article 45
  • Standard Contractual Clauses (Decision (EU) 2021/914) module selection and execution
  • Transfer Impact Assessment (TIA) under Schrems II jurisprudence
  • Supplementary measures — technical, contractual, organisational
  • BCR design for intra-group transfers
  • CLOUD Act and Section 702 conflict analysis

03

DPIA & NIS2 Scaffolding

Data Protection Impact Assessment design under Article 35, and NIS2 perimeter scoping for in-scope organisations.

  • DPIA template and methodology adapted to the organisation
  • Article 35(3) trigger evaluation per processing operation
  • NIS2 essential / important entity determination
  • Supply-chain security assessment under NIS2
  • Incident-response architecture aligned with NIS2 reporting
  • Vendor due-diligence framework with measurable criteria

03

Method

Data-protection mandates are conducted in close coordination with the General Counsel, the DPO, and the relevant operational owners. The mandate produces deliverables in three forms: technical-legal reports for internal audit, executable templates and policies for operational deployment, and structured documentation for regulator and customer inquiry.

All work is performed under bilateral confidentiality. Where the engagement crosses into adversarial territory — supervisory authority inquiry, regulatory enforcement, or contested transfer architecture — the engagement is escalated by written notice to the Managing Partner.

Engagements begin by written brief.

Submit brief