RCMWhat is this service?
GDPR compliance work means producing and maintaining the documents and practices the regulation requires: a record of processing activities, information for individuals, contracts with providers, retention periods, security measures and internal procedures.
The goal is not to collect templates but to build a file that accurately describes your practices and that you can show to a client, partner or auditor. Every document is adapted to your real tools and processing activities.
Who is it for?
This service suits organisations that already know their gaps, often after an audit, or that rely on downloaded templates that no longer match what they do.
Situations that trigger the engagement
- An audit or client questionnaire revealed missing or outdated documents.
- The website privacy policy was copied from a template and does not describe your tools.
- The company is growing, with new staff, tools and countries, and the documentation has not kept up.
- You want to answer client evidence requests in days rather than weeks.
Issues we see most often
- A record of processing filled in once and never updated.
- Different privacy notices on the website, the forms and employment contracts.
- No written rule on how long CVs, call recordings or customer data are kept.
- Documents drafted internally with no link to how teams actually work.
What the engagement includes
The scope is set from your gaps: we keep what works and produce what is missing, without rewriting everything for its own sake.
Deliverables
- Record of processing: in line with Article 30, drafted with you and easy to update.
- Privacy notices: website privacy policy, form notices, and notices for employees and candidates.
- Retention schedule: a period and a deletion rule for each category of data.
- Provider contracts: Article 28 clauses and addenda for your main processors.
- Internal policies: data security, access management, individual rights and breaches.
- Evidence file: an index of documents to answer a client or auditor quickly.
What you provide
The audit results if available, the list of your tools and providers, your current templates and a contact available to approve the documents.
Typical process
Prioritise
Start with the riskiest gaps.
Draft
Documents fitted to your tools.
Review
Validation with your teams.
Roll out
Publication and handover.
GDPR and local law for companies in Morocco
A company in Morocco that handles European data often has to meet both the GDPR, for its European clients or users, and Moroccan Law 09-08. The two texts share many principles: purpose limitation, transparency, security and individual rights.
We build a single file that covers the GDPR first, without duplicating work, and we flag the points where local law requires a specific step.
Important limits
Compliance then depends on your teams applying the documents. The documents should be reviewed whenever your processing, tools or providers change.
RCM provides compliance and DPO support. RCM is not a law firm. When specialized legal consultation or litigation representation is necessary, it must be entrusted to an authorized professional.
Frequently asked questions
Can we start compliance work without an audit?−
Yes, if your gaps are already known. Otherwise we recommend starting with an audit, or choosing a GDPR Compliance Pack that combines audit and implementation from €3,200 excl. VAT.
How much does GDPR compliance work cost?+
From €900 excl. VAT for a limited scope. The price depends on the number of processing activities, providers and documents to produce.
Will the documents be in English or French?+
Documents for European clients and partners are usually delivered in English; internal documents can be delivered in French.
Who keeps the record up to date afterwards?+
Your internal contact, using a simple method we hand over. An outsourced DPO can also take care of this from 4,900 MAD per month.
Talk about your situation
Present the context, timeline and actors. We will tell you if this service really meets your needs.
Request scoping →