RCMTargeted audit
A review of your main processing, existing evidence and GDPR gaps, ranked by priority.
GDPR consulting for small businesses.
Start with a fixed scope.
This solution combines assessment, register, priorities, essential documentation and governance to install a maintainable foundation.
ResultActionable process
PriceFrom 1 800 € tax excl.
First stepScoping
SupportAvailable later
LimitNo absolute guarantee
A solid GDPR foundation, without overdoing it.
An SME does not need a large-group programme. It needs to know which data it processes, which risks really matter and which documents must exist first. This solution combines a targeted audit, a 90-day plan and the essential documentation to set up a foundation you can maintain.
What the solution covers
Priority record
The record of processing started with the most exposed activities: customers, employees, prospecting, vendors.
Essential documents
Privacy policy, privacy notices and basic procedures (rights, incidents, retention).
Light governance
A named owner, a tracking table and a realistic review rhythm for a small team.
How the engagement works
- 01
Scope
Activities, tools, vendors and deadlines, in one call.
- 02
Audit
Short interviews and a review of available documents.
- 03
Prioritise
A 90-day plan: what comes first, and who does it.
- 04
Document
Priority record, policies and tracking table delivered.
Deliverables
- Targeted audit report and gap analysis
- 90-day action plan
- Record of priority processing
- Privacy policy and essential notices
- Compliance tracking table
Who it is for
- SMEs starting their GDPR compliance
- Companies answering a first client questionnaire
- Organisations without an in-house lawyer or DPO
Frequently asked questions
Does an SME need a record of processing? +
In most cases, yes. The exemption for organisations with fewer than 250 employees does not apply when processing is regular, risky or involves sensitive data, which covers payroll, customer management and prospecting.
How long does it take? +
The priority foundation usually takes a few weeks. The 90-day plan then organises the rest at your team’s pace.
How is this different from the Essential compliance pack? +
Readiness sets up a priority foundation. The Essential pack goes further: a full audit and documented compliance for up to 15 processing activities.
Do we need a DPO? +
Not always. It depends on your activities. Our guide What is a DPO? explains the criteria; scoping settles it for your case.
The solution covers the scope defined in the proposal. Technical implementation and external legal fees are separate where needed.