packets.build00 GDPR
GDPR compliance you can show a customer
Know what personal data you hold and why, keep your records and assessments current, and handle requests and breaches on time, with a Forward Employee, a privacy expert and AI agents on one platform.
For teams whose users, or whose customers' employees, are in Europe.
GDPR programme
- Records of processing12 activities
- DPIA: product analyticsIn review
- Data subject requestsPlaybook live
GDPR at a glance
GDPR is a law, not a certificate. These are the deadlines and duties your programme has to meet.
- 72 hours
To report a personal data breach to the regulator, where it is likely to put people at risk (Art. 33).
The regulation - 1 month
To answer a data subject request, extendable in some cases (Art. 12).
The regulation - Art. 35
A DPIA is required before processing likely to result in high risk to people.
The regulation - 4%
Of global annual turnover, or €20 million if higher: the maximum fine (Art. 83).
The regulation
01 Typical programme plan
Your path to a GDPR programme
Five stages to a programme you can evidence.
Data mapping
Weeks 1–2What personal data you hold, and where.
Platform
- Asset and vendor registers
- Custom registers for anything else you track
Agents
- Read your onboarding answers and connected tools for systems and vendors
Your packets team
- Run data mapping sessions with each team
- Spot special category and children's data
You
- Name a data owner for each area
Output Data map
02 Who works on it
Three kinds of help, one programme
Privacy work needs judgement about your data. The strip under each card shows when they are working on your programme.
- Within 5 working days
Forward Employee
Embedded in your team
Joins your team and drives the GDPR work end to end: data mapping, records, evidence and keeping the programme current.
- Runs the weekly cadence with your owner
- Keeps the records current
- Chases evidence and approvals
- Every milestone
Privacy expert
At every milestone
Leads data mapping, lawful basis decisions, DPIAs and the review. Works alongside your legal counsel, not instead of them.
- Lawful basis and records
- DPIAs
- Request and breach playbooks
- From day one
AI agents
Working from day one
Work from your company's context. They draft privacy policies, research vendors and save evidence on the right task. A person approves what counts.
- Draft privacy policies
- Research vendors
- Collect evidence
03 Trust portal
Answer the privacy questions once
Publish a Trust Center with your GDPR status, privacy controls and published policies, synced from your packets workspace. Share a link instead of filling in the same privacy questionnaire again.
- Data subject rightsImplemented
- Retention and disposalImplemented
- Breach notificationIn progress
Synced from your packets workspace · just now
04 How GDPR gets done
Platform, agents and people, for GDPR
The platform holds the records and policies. Agents draft and research. People make the privacy decisions.
Platform
What it holds
- Privacy policiesData subject rights, retention, classification, transfers and breach notification.
- RegistersProcessing activities, vendors and assets, kept as registers you own.
- Tasks and evidenceEach duty as a task, with an owner and evidence.
- Trust portalYour GDPR status on one public page.
Autonomous agents
What they do
- Policy draftsPrivacy policies tailored to how you work, waiting for approval.
- Vendor researchPublic information on the processors you use.
- EvidenceSaved on the right task, dated and versioned.
Humans →
What they implement
- Records and lawful basisArticle 30 records, with a lawful basis for each activity.
- DPIAsArticle 35 assessments on high-risk processing.
- Breach readinessArticles 33 and 34: who decides, who reports, by when.
- Data subject rightsArticles 12–22: requests answered within a month.
On file
- Breach notification policy draftApproved
- Retention policy draftApproved
Agents collect it
Your team approves it
Agents save evidence and drafts into the platform. A person on your team approves them there.
05 Compare
Four ways to get GDPR in order. One comes with someone accountable.
| Question | A compliance tool | A consultant | A hire | packets |
|---|---|---|---|---|
| Who is accountable | Your engineer | Nobody, after the engagement | Whoever you hired, once ramped | Your packets team, from week one |
| Who does the work | You | Advises; you implement | One person, part-time | Agents at volume, plus specialists |
| Records of processing | A template | A spreadsheet, handed over | Built from scratch | A register kept current |
| DPIAs | A template | Run once | If they have run one before | Run by a privacy expert, recorded |
| Policies and evidence | Templates to fill in | Document set, handed over | Written from scratch | Drafted and mapped; you approve |
| Adding a framework | Start the checklist again | A new engagement | More work, same person | Reuses controls in place |
| Year two | Renews; work still yours | Starts from scratch | Depends on them staying | Same system, nothing restarts |
| What it costs | Licence, plus the work | Project fee, no system | ₹30–35L a year, plus time to hire | One fixed price |
Hire cost from the packets comparison on packets.build. Your quote depends on scope and frameworks.
06 Features
What runs your GDPR programme
Specific to GDPR
Privacy policy set
Data subject rights, retention and disposal, data classification, information transfers and breach notification.
Registers you own
Keep your records of processing, vendors and assets as registers with your own fields.
Vendor due diligence
Your processors, their risks and the records behind them.
In every packets programme
Controls
Each control maps to the requirements it satisfies, so work counts once.
Evidence collection
Evidence on each task, with owners, versions and expiry.
Integrations
GitHub, Microsoft 365, GitLab, Cloudflare and more, checked daily.
Risk register
Privacy risks drafted from your context, approved by you, linked to controls.
Audit workspace
Internal reviews with findings and remediation tasks.
Trust portal
Your status, controls and policies on one public page.
Employee portal
Staff read and accept privacy policies and complete their own tasks.
AI agents
Draft, research and collect, so your team only reviews.
07 Framework overlap
Doing GDPR? Much of the security work counts twice.
One control can satisfy requirements in several frameworks, so GDPR gives you a head start on the next one. Each card shows how much of the main work is already done, and what is left.
StartingISO 27001after GDPR
3 of 6already done
- Security of processing controls (Art. 32)
- Incident response and breach handling
- Supplier register and due diligence
- A management system: scope, objectives, internal audit, management review
- Annex A controls and a Statement of Applicability
- A certification body
StartingSOC 2after GDPR
2 of 4already done
- Security controls and vendor management
- Privacy work, if you add the privacy criterion
- Mapping to the Trust Services Criteria
- An observation window and a CPA firm
StartingIndia's DPDP Actafter GDPR
3 of 5already done
- Your data map and records
- Notices and data subject rights processes
- Breach response playbook
- Notice and consent in the form the DPDP Act sets
- Breach reporting to India's Data Protection Board
Counts are of the main pieces of work, not a measured percentage of controls. Your scope decides the rest.
08 Which one first
Your buyers decide which framework you need
Privacy laws apply whether or not you hold a certificate.
- Anyone whose users are in EuropeGDPR readiness This page
- Anyone handling personal data of people in IndiaDPDP readiness
- Enterprise buyers in India, Europe and the Middle EastISO 27001 →
- US and Canadian enterprise buyersSOC 2 Type II →
09 After go-live
GDPR is not a project. It is how you handle data.
Products, vendors and data change. The same system and team keep your records and assessments current.
- When something changes
A new feature, vendor or data use gets its record, and a DPIA if it is high risk.
- Every request
Data subject requests tracked against the one-month deadline.
- Every quarter
Records, vendors and policies reviewed, ready for you to sign off.
- Every year
A programme review and a refreshed plan.
Already have privacy documents from a consultant?
Bring your records of processing, DPIAs, policies and vendor list. We turn them into a programme that stays current.
10 Questions
Questions about GDPR
01Is there a GDPR certificate?
No official one. You show compliance through your records, assessments, policies and processes, which is what customers and regulators ask to see.
02Does GDPR apply to us?
It applies if you offer goods or services to people in the EU or monitor their behaviour, and when you process personal data for a customer who is subject to it. We check this with you at kickoff.
03Controller or processor: which are we?
Often both. You are a controller for your own staff and marketing data, and usually a processor for the data your customers put into your product. Each role has different duties.
04Do we need a Data Protection Officer?
Only in some cases, such as large-scale monitoring of people or large-scale processing of special category data. Your privacy expert helps you decide and records the reasoning.
05What is a DPIA?
A Data Protection Impact Assessment: a structured look at processing that is likely to put people at high risk, done before you start. Your privacy expert runs it with you and it is recorded in packets.
06How fast do we need to act on a breach?
Report it to the regulator within 72 hours of becoming aware, where it is likely to put people at risk, and tell the people affected without undue delay if the risk is high. Your breach playbook sets out who does what.
07Does this cover India's DPDP Act?
Much of the work carries over: the data map, notices, rights processes and breach response. DPDP has its own notice, consent and reporting rules, which we plan with you.
08Is this legal advice?
No. packets is not a law firm. Your privacy expert works alongside your legal counsel on decisions that need legal advice.
11 Keep exploring
Before you book a call
Show your GDPR posture. Keep it current.
Talk to us about your data, your users and your customers' questions.
- A Forward Employee in your team within five working days
- A privacy expert at every milestone
- AI agents that draft and research; you approve