Record of Processing (RoPA)
Every processing activity, purpose, legal basis, recipients, retention periods, security measures.
GDPR in force since 2018 · Fines up to €20m or 4% · Hellenic DPA active on audits and complaints
See where you stand →
Regulation (EU) 2016/679 · GDPR
Privacy that holds up under a DPA audit.
We don't write yet another set of policies. We build the framework that lets you answer a DSAR within 30 days, run a DPIA when required, notify a breach within 72 hours, and prove compliance — not just claim it.
KodeX GRC builds a GDPR (Regulation (EU) 2016/679) framework you can prove under a Hellenic DPA audit: records of processing (RoPA), DPIAs where required, data subject requests answered within one month and breach notification within 72 hours. Typical project length: 8 weeks.
What it covers
GDPR is organised around three axes: what data you process and why, what rights data subjects have, and how you prove you respect them. Each area maps to specific articles and artefacts.
Legal basis & consent
Contract, legitimate interest, legal obligation, explicit consent, special categories.
Data subject rights
Access, rectification, erasure, restriction, portability, objection — 30-day SLA.
Data breach
Notification to the DPA within 72 hours, communication to data subjects, breach register.
Impact assessment (DPIA)
When it's required, how it's structured, who approves it, how it's updated.
Processors
Contracts, instructions, sub-processors, oversight, clauses, termination.
Transfers outside the EU
SCCs, adequacy decisions, Transfer Impact Assessment, transfer legal basis.
DPO
When required, role, independence, duties, communication with the authority.
Who it's for
There's no point if the data is marginal. There is when there's real exposure — volume, sensitivity, or an elevated likelihood of audit.
We work with organisations that process personal data at scale or in sensitive categories, or that have received a questionnaire from a client, partner, or the authority itself.
The rule: if you've been asked for a DPA by a client, if you transfer data outside the EU, if you profile or make automated decisions — or if you've received a complaint at the Hellenic DPA — the project has immediate value.
Companies with HR data at scale — payroll, evaluation, CCTV
Marketing & CRM with profiling, consent, tracking, cookies
Health, insurance, financial — special-category data
Anyone who received a questionnaire from the DPA or a processor client
Anyone transferring outside the EU — cloud, services, subsidiaries, SaaS
How we work
Four phases. The sequence matters: map first, then assess, then write, and finally test — not the other way around.
Data mapping
Where the data goes
Flows, recipients, retention periods, transfers, legal bases. The foundation for everything else — without it, policies are decorative.
2 weeksAssessment & DPIA
Where the risk is
Rank processing by risk, impact assessments for high-risk activities, prior consultation where required.
2 weeksPolicies & procedures
That actually work
DSAR, breach, consent, processors, DPO, staff training. Documents that can be applied.
3 weeksTest & document
Before the authority arrives
DSAR tabletop, breach tabletop, closing the gaps, delivering the full compliance file.
1 weekThe key articles
GDPR has 99 articles. These are the eight the authority asks for first — and verifies with evidence, not declarations.
Article
What it requires in practice
Priority
Art. 30 · RoPA
Record of every processing activity with purpose, legal basis, recipients, retention.
Critical
Art. 6 · Legal basis
Every processing activity has a specific basis — not "legitimate interest" for everything.
Critical
Art. 15–22 · Rights
Access, rectification, erasure, portability, objection. SLA: 30 days.
Critical
Art. 33 · Breach 72h
Notification to the DPA within 72 hours — regardless of size.
Critical
Art. 28 · Processors
Written contracts with every processor, instructions, sub-processors.
High
Art. 32 · Security
Technical and organisational measures — encryption, access, continuity.
High
Art. 35 · DPIA
Impact assessment for high-risk processing — before it starts.
High
Art. 44–49 · Transfers
Legal basis for every transfer outside the EU, documented with a TIA.
High
What you get
Six artefacts that prove compliance. None of them are documents you'll have to write yourself after we leave.
Record of Processing (RoPA)Every activity with legal basis, recipients and retention periods.
Impact assessments (DPIA)Structured, approved, updatable — for every high-risk processing activity.
DSAR processResponse template, escalation flow, 30-day SLA, register.
72-hour breach processEscalation flow, notification criteria, templates for the authority.
Processor agreementsReview and correction of existing, DPA templates for new ones.
Privacy policyPublic document aligned with actual operations — not a template.
Timeline — 8 weeks
Typical mid-sized engagement. Weeks adjust based on the number of processing activities in scope.
WK 01–02
Data mapping
Data flows, recipients, transfers, retention periods, legal bases.
WK 03–04
Assessment & DPIA
Processing ranking, impact assessments, risk prioritisation.
WK 05–07
Policies & procedures
DSAR, breach 72h, consent, processors, DPO, training.
WK 08
Test & document
DSAR tabletop, breach tabletop, closing gaps, final delivery.
Frequently asked
The questions we hear before taking on a GDPR compliance project.
Do we need a DPO?
Mandatory for public authorities, for large-scale behavioural monitoring, and for large-scale processing of special-category data. Otherwise it's optional — but useful. If you don't want a full-time role, we take on the function as a service, with clear appointment and independence.
What happens if we receive a complaint from the Hellenic DPA?
We handle the response: evidence collection, drafting the response to the authority, representation in communication, and — if needed — appearance at a hearing. This is a separate engagement from compliance, priced independently. For clients with an active maintenance contract, it's handled as a priority.
How much does GDPR compliance cost?
It depends on the number of processing activities in scope, whether a DPO exists, and how much you transfer outside the EU. After data mapping we give a fixed price — not before. We don't quote without seeing what's actually there.
Do we also need ISO 27001 for GDPR?
Not required, but it helps. GDPR Article 32 requires "appropriate technical and organisational measures" — ISO 27001 covers exactly that, with evidence. If you intend to pursue both, the sequence is: GDPR first (it's mandatory), then ISO 27001 on the same evidence base.
How does GDPR relate to NIS2?
Different scope, different authority — but they overlap. One breach can trigger both: 72-hour notification to the Hellenic DPA (GDPR) and 24-hour notification to the National Cybersecurity Authority (NIS2). If you're in NIS2 scope, we design the breach process to cover both regulations with a single flow.
Related services
GDPR rarely stands alone. It usually combines with the following, because they share artefacts, technical measures and processes.
01 · ISO 27001
Art. 32 · Technical measures
The technical security GDPR requires, documented and tested — with the evidence the authority asks for.
03 · NIS 2Overlap on breaches
One breach, two notifications — 72h to the DPA, 24h to the National Cybersecurity Authority. One flow, two compliances.
08 · vCISODPO as a service
If you don't need a full-time DPO, we take on the function part-time with clear appointment and independence.
Get started
Free gap analysis in two weeks.
A gap register prioritised by exposure, a costed 8-week roadmap, and an executive summary for the board. No commitment — you can hand it to another consultant if you prefer.
No commitment
Confidential
Greek or English