What I can do for you

Privacy statement

This is where you inform customers, website visitors and other data subjects about what you do with their personal data: which data, for what purpose, on what legal basis, how long you keep it and what rights they have.

Right to information, Articles 12 to 14 GDPR

Privacy policy and internal procedures

An internal document setting out how your organisation handles personal data and which measures you take. It helps you demonstrate that you comply with the GDPR.

Accountability, Article 5(2) and Article 24 GDPR

Data processing agreement

Does another party process personal data on your behalf, such as an accountant, payroll provider or cloud service? Then you record agreements with that party on matters such as security, confidentiality and what happens to the data when the collaboration ends.

Article 28 GDPR

Record of processing activities

An overview of all processing of personal data within your organisation, including the purpose, the categories of data, the recipients and the retention periods. Organisations with fewer than 250 employees are only exempt if they process personal data occasionally, without risk to data subjects and without special categories of data or criminal data. In practice, almost every organisation therefore needs a record.

Article 30 GDPR

Retention periods and data management

You may not keep personal data longer than necessary for the purpose for which it was collected. I help you set a retention period for each type of data, taking into account statutory retention obligations such as the 7-year tax retention period in the Netherlands.

Storage limitation, Article 5(1)(e) GDPR

Data breach procedure

A fixed approach for when things go wrong: who does what, how you assess whether a breach must be reported and how you record it. You must record all data breaches internally, even those that do not need to be reported.

Articles 33 and 34 GDPR

Terms and conditions

The standard terms that apply to your services or products. I draft or review them and make sure they align with your privacy documentation.

Dutch Civil Code, Book 6, Section 6.5.3

Review of existing documentation

Already have documents in place? I assess whether they are complete, up to date and in line with how you work in practice.

Privacy scan

A review of your organisation: which personal data do you process, how do your processes work and which documentation and measures are already in place? The scan shows what is missing and what still needs to be done, after which I support you in making the changes.

DPIA

A DPIA (data protection impact assessment) maps the privacy risks of a processing operation in advance, along with the measures to reduce those risks. A DPIA is mandatory when processing is likely to result in a high risk to data subjects, for example large-scale processing of health data or large-scale camera surveillance. The Dutch Data Protection Authority has published a list of processing operations for which a DPIA is always required.

Article 35 GDPR

Process review

I look at how your processes work in practice, for example when hiring staff or keeping customer records, and whether this matches your documentation and the rules. Where things can be more privacy-friendly, I will tell you.

Advice on privacy and compliance

For your questions about the GDPR, such as whether you may process certain data, on what legal basis, and how to handle people who want to access or delete their data.

New systems, software and suppliers

When choosing new software or a new supplier, you take privacy into account from the start (privacy by design and privacy by default). I help you assess whether a system or party offers sufficient safeguards.

Article 25 and Article 28(1) GDPR

Data breaches

A personal data breach is a security incident in which personal data is lost, destroyed or altered, or ends up with someone who is not allowed to see it. Think of an email sent to the wrong recipient or a stolen laptop. You must report a breach to the Dutch Data Protection Authority within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to data subjects. If the risk is high, you must also inform the data subjects themselves.

Article 4(12), Articles 33 and 34 GDPR