RCMWhat is this service?
This service prepares your organisation for two situations that always arrive at the worst moment: a personal data breach, and a request from an individual to exercise their rights, such as an access request from a former employee or an unhappy customer.
In both cases the GDPR sets short deadlines: 72 hours to notify the supervisory authority of a breach that presents a risk, and one month to answer a rights request. The service puts in place the procedures, roles and templates you need to meet those deadlines without improvising.
Detect
Qualify
Decide
Notify if required
Who is it for?
It is designed for organisations where security, customer support, HR, legal and management do not yet share a common process for these situations.
Situations that trigger the engagement
- A recent incident (email sent to the wrong person, lost laptop, unauthorised access) showed that nobody knew who decides.
- An access or erasure request was answered late or incompletely.
- A European client requires an incident procedure in the processing agreement.
- You are preparing for a certification or security audit and need to document the personal data side.
Issues we see most often
- Incidents are handled as technical tickets, without assessing the risk for individuals.
- No breach log is kept, although the GDPR requires every breach to be documented, even when it is not notified.
- Rights requests arrive through several channels (email, web form, social media) without being centralised or dated.
- The requester’s identity is not verified, or is verified in a disproportionate way.
What the engagement includes
The engagement covers both processes, breaches and individual rights, and can be limited to one of them if the other already exists.
Deliverables
- Breach management procedure: detection, risk assessment, notification decision, communication to individuals and closure.
- Decision matrix: a simple grid to decide within 24 hours whether a breach must be notified.
- Breach log: a ready-to-use template in line with Article 33(5) GDPR.
- Rights request procedure: receipt, identity check, data search, response and archiving.
- Response templates: access, rectification, erasure, objection and reasoned refusal, in English and French.
- Simulation exercise: a realistic scenario played with your teams to test the procedure.
What you provide
Contacts for the people involved (IT, support, HR, management), your existing procedures, the list of channels where requests arrive, and two or three past incidents if you have them.
Typical process
Map
Channels, people and past incidents.
Draft
Procedures, matrix and templates.
Simulate
An exercise with your teams.
Refine
Corrections and final version.
Service providers in Morocco working for European clients
If you process data for a European client, you are usually its processor. The GDPR then requires you to inform the client without undue delay of any breach, and the client decides whether to notify the authority. Many contracts set a precise deadline, often 24 to 48 hours.
The procedure we draft separates these two roles clearly, so your teams know whom to alert, how quickly and with what information, depending on whether you act as controller or processor.
Important limits
This service prepares your organisation; it does not replace an IT security incident response team. In a live emergency, availability and scope are confirmed before any intervention.
RCM provides compliance and DPO support. RCM is not a law firm. When specialized legal consultation or litigation representation is necessary, it must be entrusted to an authorized professional.
Frequently asked questions
Does every data breach have to be notified?−
No. A breach must be notified to the authority when it presents a risk to individuals’ rights and freedoms, and communicated to the individuals when that risk is high. Every breach, however, must be recorded in an internal log.
How long do we have to answer an access request?+
One month from receipt. This can be extended by two further months for complex requests, provided the individual is informed within the first month.
How much does this service cost?+
From €700 excl. VAT for a simple process. The price depends on the number of entities, request channels and whether the simulation exercise is included.
Can you assist us during a real incident?+
Yes, as part of an outsourced DPO service or a one-off engagement confirmed case by case. Having the procedure in place before an incident remains the best protection.
Talk about your situation
Present the context, timeline and actors. We will tell you if this service really meets your needs.
Request scoping →