GDPR · General Data Protection Regulation
GDPR compliance consulting for personal data you can account for, to anyone who asks.
Build a GDPR compliance programme that satisfies regulators, your customers' auditors and the people whose data you process: lawful bases decided, records of processing kept, rights requests answered on time, breaches managed inside 72 hours and transfers covered. Sterling's expert and experienced consultants design the programme with your legal, technology and operations teams, prepare the evidence and stay with you after it is in place, in 60+ countries. We ensure a successful GDPR compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling prepares the programme and the evidence; compliance is assessed by regulators and your customers' auditors
8,100+ client engagements in 60+ countries.
GDPR client experience
What it is
What is the GDPR and what does it require?
The General Data Protection Regulation is the European Union's personal data law. It applies across the EU and, through the EEA Agreement, in Iceland, Liechtenstein and Norway, and reaches organisations outside Europe that serve or monitor people inside it. It sets principles for every use of personal data, gives individuals enforceable rights, assigns duties to the organisations that decide why and how data is processed (controllers) and to those that process it for them (processors), restricts transfers out of the EU and backs it all with supervisory authorities that can ban processing and, under Article 83, fine up to €10 million or 2% of total worldwide annual turnover of the preceding financial year for breaches of controller and processor duties, and up to €20 million or 4% for breaches of the principles, lawful bases, rights and transfer rules, whichever is higher.
There is no GDPR certificate to obtain. Compliance is a state you must be able to demonstrate: Article 5(2) makes the controller responsible for showing that the principles are met, and Article 24 requires measures that prove processing follows the Regulation. A working programme is therefore decisions (why each activity is lawful), documents (records, notices, contracts, assessments), controls (security, retention, access) and evidence that they operate. A folder of policies downloaded in 2018 is none of those.
Current text. Regulation (EU) 2016/679 of 27 April 2016, applicable since 25 May 2018, is the text in force. The European Commission has proposed changes to reduce administrative burden, including a wider record-keeping exemption for smaller organisations; until adopted, the existing text and thresholds apply. In the United Kingdom the UK GDPR applies alongside the Data Protection Act 2018, amended by the Data (Use and Access) Act 2025, whose data protection provisions commence in stages; the Commission renewed its UK adequacy decisions in December 2025. GDPR vs UK GDPR: what differs and what does not
Who it is for
Who needs to comply with the GDPR?
Scope under Article 3 depends on where you are established and whom you serve, not where your servers sit. An EU or EEA establishment brings all of its processing in; a company in Manila, Dubai or Singapore with no European office is caught as soon as it offers goods or services to people in the EU, paid or not, or monitors their behaviour there, and usually then needs an EU representative under Article 27. Organisations come to Sterling from four starting points:
- A customer's due-diligence questionnaire or contract demands it. European clients and their auditors ask BPOs, software providers and shared service centres for an Article 28 processing agreement, Article 32 security evidence and proof that the sub-processor chain is under control. The answer has to be documents, not assurances.
- You sell or market to people in Europe. An online shop, an app, a SaaS product or a recruitment campaign that reaches EU residents brings the Regulation with it, with transparency, consent and representative obligations a non-EU business rarely discovers alone.
- You are established in the EU or the UK and have never done it properly. The 2018 project produced a privacy notice and a cookie banner; nobody kept the record of processing, decided lawful bases or tested the breach procedure, and a new system or a complaint exposes the gap.
- You process personal data for other organisations. Processors carry their own duties: records of processing categories, security, sub-processor authorisation, breach notification to the controller and help with rights requests. A processor's programme differs from a controller's; a good one wins contracts.
Business benefits
How GDPR compliance supports customer trust and business control
A privacy programme earns its cost where personal data meets commercial pressure: a client audit, a lost laptop, a marketing list of uncertain origin, an access request from an ex-employee. We start from those moments and give each an owner, a procedure and evidence.
- Contracts that closeProcessing agreements, sub-processor lists and security evidence ready before a European client's procurement team asks, so due diligence is a formality.
- Breaches handled, not improvisedA tested procedure that assesses the risk, notifies the supervisory authority within 72 hours where required, tells affected people when the risk is high and records every incident, reportable or not.
- Rights requests inside the monthAccess, erasure, rectification, portability and objection requests logged, verified and answered within Article 12's one-month limit, with a searchable inventory behind them.
- Data you can actually findA record of processing that maps systems, purposes, categories, recipients, retention and transfers, and doubles as the map for clean-ups and supplier exits.
- Lower exposureLawful bases documented, minimisation and retention applied, DPIAs done before high-risk processing starts: shorter regulator conversations and less room for Article 83 fines.
- One programme across lawsThe same inventory, roles, procedures and controls extended to the UK GDPR, the Philippine Data Privacy Act, the UAE Personal Data Protection Law or India's Digital Personal Data Protection Act, not a project for each.
Measure the programme by numbers that matter: activities with a documented lawful basis, median time to answer a rights request, hours from breach discovery to risk assessment, processors with a signed agreement. A policy count is not one of them.
Requirements
What are the main GDPR requirements?
The Regulation runs to 99 articles in eleven chapters; the obligations that shape a programme sit in a handful of them. The table maps them to practice. During the programme your processing is checked against the Regulation's own text; legal interpretation stays with your legal advisers.
| Article | What it requires of you | What it looks like in practice |
|---|---|---|
| Art. 5 Principles | Process personal data lawfully, fairly and transparently, for specified purposes, minimised, accurate, kept no longer than necessary and secure, and be able to demonstrate it (accountability) | A data inventory with purpose, retention and security per activity, and a file of the decisions behind each one |
| Art. 6, 7 and 9 Lawfulness, consent and special categories | Identify one of the six lawful bases for every activity; where consent is used, be able to prove it, keep it distinguishable and as easy to withdraw as to give; meet an Article 9 condition before processing health, biometric or other special-category data | A lawful-basis register, legitimate-interest assessments, consent records with wording and timestamps, Article 9 conditions documented for HR and health data |
| Art. 12 to 22 Transparency and data subject rights | Tell people what you do with their data when you collect it; answer requests for access, rectification, erasure, restriction, portability and objection within one month, free of charge in principle; respect the limits on solely automated decisions | Notices per audience, a request procedure with identity checks and a log, a template per right and a way to find every record about one person |
| Art. 24 to 30 Controller and processor duties, records of processing | Implement and review measures that demonstrate compliance; build data protection in by design and by default; designate an EU representative where Article 27 applies; use only processors with sufficient guarantees, under contracts with the Article 28(3) terms; keep a written record of processing (as controller: purposes, categories, recipients, transfers, retention, security; as processor: categories of processing per controller) for the supervisory authority on request, the under-250-staff exemption falling away where processing is not occasional, carries a risk or involves special-category or criminal-conviction data | Proportionate policies, privacy gates in projects and procurement, a processor register with signed agreements and sub-processor approvals, and the record of processing generated from the data inventory and kept current |
| Art. 32 to 34 Security and personal data breaches | Apply technical and organisational measures appropriate to the risk, which may include pseudonymisation and encryption, resilience, restoration of access and regular testing; notify the supervisory authority of a breach without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to result in a risk; tell affected people without undue delay when the risk is high; processors notify their controllers; document every breach | A personal-data risk assessment with the controls that treat it, aligned with ISO/IEC 27001 where you have it; an incident procedure with a risk-assessment step, templates, a breach register and a rehearsal |
| Art. 35 and 36 Data protection impact assessment | Before processing likely to result in a high risk (new technologies, systematic profiling, large-scale special-category data, large-scale monitoring of public areas), assess necessity, proportionality, risks and safeguards with the DPO's advice; consult the supervisory authority where the risk would remain high | A DPIA screening question in every project, a DPIA template and register, sign-off recorded before go-live |
| Art. 37 to 39 Data protection officer | Designate a DPO where you are a public body, where core activities involve regular and systematic monitoring on a large scale, or large-scale special-category or criminal-conviction data; publish the contact details, involve the DPO properly, protect their independence and let them report to top management | A documented DPO decision (appointed or not, and why), a role description covering the Article 39 tasks, contact details notified to the supervisory authority |
| Art. 44 to 49 Transfers to third countries | Transfer personal data outside the EU and EEA only to countries with an adequacy decision, under appropriate safeguards such as the Commission's standard contractual clauses or binding corporate rules, or under a narrow derogation | A transfer map covering cloud hosting, group companies and support teams, the safeguard recorded per transfer and revisited when a decision changes |
What does useful GDPR evidence look like?
A record of processing that matches the systems people actually use, lawful-basis decisions with their reasoning, notices where data is collected, signed processor agreements and a current sub-processor list, DPIAs for the high-risk activities, a breach register including the incidents you decided not to report and why, a rights-request log with response dates, transfer records naming the safeguard, and training records. We build these from your real processing and keep them in Effivity from the first workshop, so a regulator or a client auditor sees a programme that runs.
GDPR requirements explained, article by articleCompliance process
How do you become GDPR compliant?
Compliance is built, operated and then demonstrated, in that order. Sterling designs and builds the programme with your team; whether it is enough is judged by the supervisory authority, your customers' auditors and any assessor you engage, none of whom takes a consultant's word for it.
- 01Define what the programme needs to cover.Confirm the entities, countries and sites, your role as controller or processor per activity, whether Article 3 reaches you from outside the EU, whether a representative or DPO is required, and who will judge the result.
- 02Gap analysis: review the current position against the Regulation.The gap analysis inventories processing activities, systems and data flows, tests existing notices, contracts, controls and procedures against each obligation, keeps what works and agrees actions, owners and dates.
- 03Implement, and keep the evidence as you go.Decide lawful bases, write the notices and policies, sign the processor agreements, put retention, access and security controls into use, complete the DPIAs due, train the people who handle data and record it as it happens.
- 04Audit, review and address the findings.An internal audit against the Regulation and a management review with the DPO or privacy lead show what operates and what does not; findings are raised by us first and closed with evidence.
- 05Complete the regulator or customer review.Answer a client audit, a regulator enquiry or a due-diligence questionnaire from an evidence package that already exists, or take the programme to ISO/IEC 27701 or an approved Article 42 scheme if a certificate is wanted.
- 06Maintain the programme after it is in place.New systems trigger DPIA screening, new suppliers trigger agreements, requests and breaches are logged and reviewed, the record follows change, and the annual internal audit and management review keep the programme on track as law and business move.
Judge an offer by what it leaves behind. Ask who does the data mapping, who decides lawful bases, whether the templates are adapted to your processing, what your people will learn and where the evidence will live. "GDPR certified in days" packages sell a certificate that does not exist; a client auditor or a regulator looks past the seal to the record of processing. How to choose a credible GDPR provider · The certification buyer's checklist
Cost
How much does GDPR compliance cost?
The price of a GDPR programme follows the volume and sensitivity of the personal data, the systems and suppliers that touch it and how much groundwork exists: a ten-person software company and a thousand-seat BPO handling health data for European clients need different programmes. What is constant in a Sterling proposal: every component visible, the fee fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Processing activities, systems and suppliers to map, controller and processor roles, jurisdictions, deliverables, and how much of the work your team takes on (Design™ or Drive™) |
| Independent review | Fees of any third-party assessor, ISO/IEC 27701 certification body or Article 42 scheme you choose, shown separately; client audits and regulator enquiries cost time, not fees |
| Internal resources and legal | Process-owner time for data mapping, DPO or privacy-lead capacity, IT effort for access, retention and security changes, training hours, remediation, and any legal review, EU representative service or UK data protection fee |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, DPIA support, regulatory watch, refresher learning and updates for new laws under Sustain™ |
What moves the price
- Processing activities, systems and suppliers, and whether data flows are already mapped
- Controller, processor or both, and whether special-category or children's data is processed
- Countries in scope: the EU only, or the UK, the Philippines, the UAE or India too
- Whether a DPIA backlog, a transfer review or a retention problem must be cleared
- The deadline set by a client audit, a contract or a regulator
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Assessor, certification and legal fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does GDPR compliance take?
Three to eight months is the realistic range: shorter where an ISO/IEC 27001 system and a data inventory already exist, longer where hundreds of processing activities, many suppliers and several countries must be mapped and contracted. The pace is set less by document writing than by decisions on lawful bases, retention and transfer mechanisms, and by the time controls need to operate and leave evidence. We plan around those decisions, with milestones in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to system owners, contracts and existing records, and how fast the data inventory can be completed |
| Build and implementation | Decisions on lawful bases and retention, negotiation of processing agreements, IT changes for access, deletion and security, and training |
| Evidence and review | Controls operating long enough to generate records, DPIAs completed, then internal audit and management review |
| Regulator or customer review | The timing of client audits, questionnaires or regulator enquiries and, if a certificate is wanted, the certification body's schedule for ISO/IEC 27701 or an Article 42 scheme |
If a client audit date or a contract deadline exists, share it at the outset. We will say what can be in place by then and which decisions must be made early. A promise of full compliance in a fortnight, made before anyone has seen your data flows, is a warning sign, not a plan.
Challenges
Common GDPR implementation challenges
Most GDPR programmes stall on the same five problems. Each has a practical answer.
Nobody can say which personal data the organisation holds, or where.
We run data mapping with system owners, department by department, recording purpose, categories, recipients, retention and transfers per activity. The output is the Article 30 record and the basis for every rights request and retention decision.
Consent is used for everything, and half of it was never recorded.
Most processing rests on contract, legal obligation or legitimate interests, not consent. We decide the basis for each activity with your legal advisers, document legitimate-interest assessments where they apply and reserve consent for the cases that need it, with records to prove it.
Suppliers and group companies handle data without agreements or transfer safeguards.
A processor register, a contracting plan with the Article 28 terms, a sub-processor list and a transfer map with the safeguard chosen per flow; hardest suppliers first, so the residual list is short.
Rights requests and breaches are handled by whoever sees the e-mail first.
One intake route for requests, an identity check, a log with the one-month clock and retrieval through the data inventory; for breaches, a risk-assessment step, decision owners and templates ready for the authority and for affected people.
Several data protection laws apply and each team follows a different one.
One programme with a common core (inventory, roles, notices, contracts, controls, breach and request procedures) and a jurisdiction layer for the UK GDPR or the Philippine, UAE or Indian law, so differences are documented, not improvised.
Your engagement
What your GDPR engagement includes
Your agreed scope covers what a working programme and a prepared team need, from one team, under one all-inclusive proposal: the mapping, the decisions, the documents, the software, the training and the review that proves it operates.
Scope, gap analysis and implementation plan
Roles, jurisdictions, systems and suppliers confirmed; every obligation tested against the current position; actions, owners and dates agreed before work starts.
Data mapping, records and documentation
The record of processing, lawful-basis and retention decisions, notices, policies, processor agreements, DPIA and breach procedures, built on Sterling's template sets and adapted to your processing.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before a client, a regulator or a certification body looks.
Review readiness and support
Preparation for client audits, questionnaires and regulator contact, and support through ISO/IEC 27701 or Article 42 certification if you pursue one.
Compliance is assessed by regulators and your customers' auditors. Sterling's work is consulting, not legal advice.
How we deliver
How Sterling supports your GDPR implementation
Every GDPR engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. You decide how much of the work your team carries; method, software and accountability stay the same.
- 01Design™Guided implementation: your privacy lead and process owners build the programme with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the mapping, drafting and contracting work with your teams and legal advisers.
- 03Sustain™Operation after go-live: DPIA support, breach and request reviews, the annual internal audit, refreshers and new-hire training, year after year.
- 04Automate™The programme in Effivity: the record of processing, risks, DPIAs, requests, breaches, suppliers, audits and management review in one workspace.
- 05Revise™Changes in law and decisions, such as UK GDPR amendments, new adequacy decisions or a changed transfer mechanism, and changes in your scope, systems or countries.
Week one fixes the engagement team, the weekly working session, the deliverables and who decides what. Progress is then reviewed against those commitments, so a gap shows in week three, not mid-audit.
How Sterling OS™ worksOften combined with
Standards organisations pair with GDPR
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · GDPR programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the GDPR.
Every Sterling GDPR engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the record of processing, lawful-basis and retention decisions, privacy risks, DPIAs, processor agreements, transfers, rights requests, breaches, training records, internal audits and management review live in one place and a client auditor or a regulator sees a live system, not a folder assembled the week before. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Accountability, purposes and retention
Each processing activity carries its purpose, data categories, retention period and security measures, so the Article 5 principles are recorded per activity, not asserted in a policy.
Lawful bases, consent and special categories
The basis chosen for every activity, legitimate-interest assessments where they apply, consent records with wording and timestamps, and the Article 9 condition recorded for special-category data.
Requests logged, verified and answered on time
One log for access, erasure, rectification, restriction, portability and objection requests, with identity checks, the one-month deadline visible, extensions with reasons and the response kept as evidence.
Suppliers, agreements and sub-processors
A processor register with Article 28 agreement status, sub-processor approvals, security evidence and review dates, so due diligence has a record.
The Article 30 record, generated rather than retyped
The record of processing produced from the data inventory in the form a supervisory authority expects, updated through change control when a system, supplier or purpose changes.
Risks, controls and breach management
A privacy risk register linked to the controls that treat each risk, and an incident workflow with the risk-assessment step, the 72-hour clock, notification templates and the breach register.
DPIA screening, assessment and sign-off
A screening question for every new project or system, a DPIA template covering necessity, proportionality, risks and measures, the DPO's advice recorded and approval before processing starts.
Audits, training, transfers and management review
The internal audit programme and findings, training records linked to Sterling Academy, the transfer map with its safeguards, and a management review recording inputs, decisions and actions; forms and reports adapted to your work, without code.
What this means at the audit
A client's auditor asks for the record of processing, the last DPIA, the breach register, the processor agreements and the training records; a supervisory authority asks the same with a deadline attached. In Effivity each is a screen with dates, owners and evidence. Sustain™ then runs in the same workspace, so the next questionnaire is answered from a system that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your inventory, registers and records migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, QMS, BCMS and more when you integrate other standards
GDPR client experience
Client letters on file, available on request.
Signed client letters for GDPR are available on request. The client feedback wall lists every letter by standard.
Programmes with the GDPR in scope
How the GDPR fits a wider assurance programme.
- 01Read the case study
IT: GDPR compliance turned into a source of client trust
An IT company found the GDPR daunting and needed to bring its handling of personal data into line with it. Privacy by design and firm controls made data breaches and GDPR violations far less likely. Demonstrable compliance reassured customers that their data was used responsibly, strengthening the company's reputation and supporting growth; its chief data officer said data privacy has become a core strength and a turning point for client trust and the business.
- 02Read the case study
Banking and financial services: service quality, data protection and uninterrupted service
A bank and financial services provider needed better customer service, stronger data protection and continuity through disruption. It implemented ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO 22301 and PCI DSS, and worked to the GDPR. Standard processes and customer feedback raised satisfaction and retention, and the security, privacy and payment controls reduced cyber risk and kept it compliant. Its chief operations officer called ISO 22301 the missing piece, since protecting the bank also means uninterrupted service to customers.
Sterling Academy · GDPR e-learning
Train every employee on the GDPR, not just the privacy team.
Sterling Academy trains the whole workforce and the people who run the programme: video lessons with checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- GDPR awareness for every employee, the staff training Article 39 puts under the DPO's watch
- Practitioner courses for the privacy lead, process owners and the people who answer requests and handle incidents
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Learner progress by department and a training report for an auditor or a regulator
- New hires trained as they arrive, so evidence is current when the next questionnaire lands
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for a GDPR programme
Who learns what, from the front desk to the DPO.
GDPR Awareness
What personal data is, the principles and rights the Regulation gives people, what each employee does when a request, a suspicious e-mail or a lost device appears, and why. Awareness evidence for every employee.
View the courseDocumented Information Management
Controlling the documents a GDPR programme depends on (notices, policies, agreements, the record of processing, DPIAs) with versions, owners and approval, so the current version is in use and evidence is retrievable.
View the courseNonconformity Management
Treating a missed request deadline, an unauthorised disclosure or an unsigned processor agreement as a nonconformity: containment, root cause, corrective action and evidence that the fix worked.
View the courseRisk Management
Assessing risk to the rights and freedoms of individuals, the yardstick of Articles 24, 32 and 35, from screening a new project to completing a DPIA and deciding when to consult the supervisory authority.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the programme against the Regulation, with exercises on your own processing and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO/IEC 27001, ISO 9001, ISO 14001, ISO 45001, ISO 22000 and HACCP and more, so one workforce trains on one platform.
See all coursesSterling consulting clients arrange access through their consultant. Academy certificates are training certificates; they do not certify GDPR compliance, which regulators and your customers' auditors assess.
Keep exploring
Explore more about GDPR
Watch a video on how to comply with GDPR here.
Watch a video on GDPR requirements here.
GDPR resources
Services for GDPR
Why Sterling
Want successful GDPR compliance? Come to Sterling.
Whether you are a European company putting the programme right or a BPO, software or services business outside Europe answering European clients, Sterling builds one GDPR programme with clear local ownership, working through controller and processor roles, jurisdictions and what each contract demands, so growth in Europe needs no project per client.
Management systems in 60+ countries since 2003
Privacy and security programmes implemented for BPOs, software companies, banks, healthcare providers and manufacturers across every region we serve, with one engagement team accountable in every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with assessor, certification and legal fees identified separately. No surprises, ever.
A programme your people can operate
Less paperwork and more control: the inventory, procedures, training and software connected to the way data actually moves, so staff follow the programme because it fits their work.
Expert and experienced consultants
Consultants who have advised on security and privacy management systems across sectors and countries since 2003, and who build the programme properly the first time, so a client audit confirms what already works.
The Sterling Promise
What our GDPR compliance success guarantee means
We stay with you until the agreed GDPR programme outcome is achieved: the mapping done, the decisions documented, the controls operating, the evidence in place and your team able to answer the next audit, questionnaire or request without us in the room. Clear explanations, practical delivery, included software and employee learning make the investment a capability, not a binder.
The engagement defines the roles, jurisdictions, scope, outcome and responsibilities. Your organisation supplies accurate information about its processing, gives access to the systems and contracts in scope and operates the agreed controls. Compliance is assessed by regulators and your customers' auditors; legal interpretation remains with your legal advisers. Our commitment covers the agreed programme support; it is not legal advice or a warranty against every breach or complaint.
After the programme is in place
What happens after GDPR compliance?
Compliance is not a date. New systems, suppliers, campaigns and countries change the processing, people join and leave, requests and incidents keep arriving, and the law moves: adequacy decisions are adopted or challenged, guidance is issued and, in the UK, the Data (Use and Access) Act 2025 commences in stages. The programme absorbs each through DPIA screening, contract updates, the record of processing and the annual audit and review.
Under Sterling OS™ Sustain™ we run that cycle with you: DPIA support for new projects, a review of requests and incidents, a regulatory watch for the jurisdictions in scope, refresher training and the internal audit, so the programme is current when a client or regulator asks.
FAQs
Frequently asked questions about the GDPR
Is there such a thing as GDPR certification?
Not in the way ISO certification exists. Article 42 allows voluntary certification, issued by bodies accredited under Article 43 against criteria approved by a supervisory authority or the European Data Protection Board; the Board's register lists only a handful of approved mechanisms, Europrivacy among them, and Article 42(4) says certification does not reduce the controller's or processor's responsibility. A "GDPR certificate" from outside that register is a badge, not a certification.
Does ISO/IEC 27701 or ISO/IEC 27001 make us GDPR compliant?
No standard does. ISO/IEC 27701 is a certifiable privacy management system standard that maps closely to the GDPR's obligations, and ISO/IEC 27001 evidences the security Article 32 asks for; both are strong evidence of a managed programme. Neither is an Article 42 certification, and neither replaces the legal analysis of your lawful bases, notices, contracts and transfers.
We are outside the EU. Does the GDPR really apply to us?
If you offer goods or services to people in the EU, paid or free, or monitor their behaviour there, Article 3(2) applies wherever you are, and Article 27 usually requires a representative in the Union. If you process personal data for an EU client as a processor, your obligations arrive through the Regulation and the Article 28 contract the client must sign with you.
Do we need a data protection officer?
Article 37 requires one for public bodies, for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, and for those whose core activities involve large-scale processing of special-category or criminal-conviction data. Others appoint one voluntarily. Either way, document the decision; the DPO may be an employee or a contractor, acts independently and reports to top management.
What has to happen within 72 hours of a breach?
Article 33 requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals; a late notification must explain the delay. Where the risk is high, Article 34 requires affected people to be told without undue delay. Processors notify their controllers, and every breach, reported or not, goes in the register.
Which records does a small company have to keep?
Article 30 exempts organisations with fewer than 250 employees from the record of processing only where processing is occasional, unlikely to result in a risk and involves no special-category or criminal-conviction data. Payroll, HR files, customer accounts and marketing are not occasional, so most small organisations keep the record. The Commission has proposed widening the exemption; until adopted, the current text applies.
Can we transfer personal data to our offices or suppliers outside the EU?
Yes, within Chapter V: to countries with an adequacy decision (the United Kingdom, Japan, Switzerland, the Republic of Korea, Brazil and others, and US companies participating in the EU–US Data Privacy Framework), under appropriate safeguards such as the Commission's standard contractual clauses or binding corporate rules, or under a narrow Article 49 derogation. The Data Privacy Framework decision of July 2023 survived a General Court challenge in September 2025 and remains in force; mechanisms have fallen before, so keep the transfer map current and confirm the position with your legal advisers.
Does Sterling give legal advice?
No. Sterling designs and builds the programme, prepares the documents and evidence and trains your people; interpreting the law for your facts, and signing off notices, contracts and lawful bases where a legal opinion is needed, sit with your legal advisers. We work alongside them so their time goes on judgement, not drafting.
What do you need to prepare a GDPR proposal?
Your role for the data you hold (controller, processor or both), the countries and entities involved, roughly how many systems and suppliers process personal data, whether special-category data is involved, what exists today and any deadline from a client, a contract or a regulator. That is enough for a scoped, all-inclusive proposal; there is no need to map your data first.
Before the first call
Prepare a useful GDPR readiness brief
You do not need a data inventory before the first discussion. Bring a short account of the personal data the business touches and who is asking. Seven questions are enough:
- Who is asking, and what do they want to see: a client questionnaire, a contract clause, a regulator letter, or your own concern?
- Are you a controller, a processor or both, and for which activities? Which EU or UK entities, customers or data subjects are involved?
- Which systems, cloud services and suppliers hold personal data, and where?
- Do you process special-category data (health, biometric and the like), children's data or data used for profiling?
- What already exists: notices, agreements, a record of processing, a breach procedure, an ISO/IEC 27001 system?
- Who can make decisions and give time: a privacy lead or DPO, legal counsel, IT, the process owners?
- Is there a client audit, a contract date or a regulator deadline to plan around?
With these seven answers the scope and the all-inclusive proposal can be set realistically. They prepare a conversation; they are not a scored assessment or a legal opinion.
Don’t be fooled by certification scams
If it takes ten days, it is not GDPR compliance.
Because no GDPR certificate exists, the market sells substitutes: seals and badges for a fee, "GDPR certified" training certificates presented as company credentials, template packs with another firm's name still in them and cookie banners sold as compliance. They cost less than a programme, until a client's auditor asks for the record of processing or a regulator asks how a breach was assessed.
How to choose a credible GDPR provider
- Ask what will exist at the end, a record of processing, lawful-basis decisions, notices, agreements, DPIAs, procedures and trained people, and who produces each.
- Ask what any offered "certificate" or seal actually is. Check the European Data Protection Board's register of approved Article 42 mechanisms; if the scheme is not there, it is not GDPR certification, whatever the badge says.
- Ask how the programme will be built from your real processing, with system owners and your legal advisers, not from a questionnaire and a template pack.
- Identify who carries each task, which legal, assessor or certification costs are separate, and what support exists when an audit or a breach tests the programme.
- Ask what your people will be taught and where the evidence will sit. A programme on the consultant's laptop leaves with the consultant.
- Walk away from "GDPR compliant in 48 hours", "GDPR certified" seals and a cookie banner sold as compliance. Compliance is demonstrated by a programme that operates; Article 5(2) puts that burden on you, not on a badge.
Keep exploring
More on GDPR and related standards
Every GDPR guide
More in Privacy & data protection
Talk to a consultant
Plan your GDPR compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice