Your GDPR posture, scored — and a roadmap to fix it.

1 · WHOSE RULES APPLY?

• You’re established in the EU/EEA or the UK, or you target those markets → yes — delivered directly by the founder. Measuring what you have against what a regulation requires is compliance work, not reserved legal practice, which is why a senior assessment is available here at a fraction of a consultancy — lawfully, and in the open.
• Another regime → tell us which in the enquiry. Most assessment work is open on the same basis; a few markets reserve formal advice on local law to admitted lawyers. We confirm within one business day, before any charge.

2 · WHAT THE ASSESSMENT PRODUCES

• A findings report — your actual position measured against the Articles, cited, severity-ranked, with a prioritised remediation roadmap and the evidence trail behind each finding → that’s exactly what we deliver.
• Something you can hand over — to a buyer’s diligence team, an enterprise procurement reviewer, or your board, without translating it first.

3 · WHERE THE LINE SITS

• Reserved work → representation before a supervisory authority, regulator or court; conducting litigation; filings or notifications made on your behalf; notarial acts; a formal legal opinion in a market that restricts who may give one. That’s an admitted lawyer, and we’ll say so and route you rather than blur the line — introduced and coordinated by us, contracted by you directly.
• Statutory appointments → naming a DPO, an Article 27 EU Representative or an AI Act Authorised Representative is a separate engagement with its own terms and its own liability, not something an assessment includes. If the assessment finds you need one, we’ll tell you — and we can take the role under a separate mandate.
• Privilege → an assessment report is a written record of where you currently stand, and it is not covered by legal professional privilege. For most readiness work that’s the point — it’s evidence you’re looking honestly. Where there’s live investigation, complaint or litigation exposure, that calculus changes, and we’ll say so before we write rather than after.
• What it is and isn’t → an assessment is a dated snapshot against the law as it stands on the day. It doesn’t itself make you compliant, and it doesn’t bind a regulator’s view.

We are not a law firm and don’t hold ourselves out as one. No court work, no filings, no regulated titles, no privilege. Tell us where you’re established and what needs assessing — scope is confirmed within one business day, and you’re never charged before it is.