Consulting & Compliance

The company processed large volumes of personal data but wasn't sure it complied with GDPR. The lack of documentation exposed it to sanctions and to problems in its relationships with partners.

We carried out a full GDPR audit, drew up the record of processing activities (ROPA), wrote the necessary policies and implemented the technical measures — encryption, access control and data minimisation. We trained the team on day-to-day obligations.

Compliance became part of the way of working, not a file left on a shelf. With up-to-date registers and a trained team, the company responds quickly to requests from data subjects and partners, turning data protection from an obligation into a trust advantage.

The institution needed to prepare for DORA requirements but had no clear picture of its IT risks, vendor dependencies and operational resilience capacity.

We mapped ICT risk, built the register of critical third parties, assessed the continuity and recovery plans and delivered a prioritised roadmap to DORA compliance, with steps, owners and deadlines.

The roadmap gave management clarity and control over a domain initially perceived as a regulatory burden. Prioritised steps, clear owners and realistic deadlines turned DORA compliance from an unknown into a manageable project, tracked like any other business initiative.

IT investments were made reactively, under pressure, with no long-term strategy. Money was spent on solutions that overlapped or didn't fit, with no big-picture vision.

We took on a CTO-on-demand role: we built an IT strategy aligned to business goals, evaluated and selected the right vendors and planned the budget over an 18-month horizon, eliminating redundant spending.

With a coherent IT strategy, investments started reinforcing each other instead of overlapping. The company now makes technology decisions in advance, aligned to its growth plans, and has a partner who translates its business needs into architecture and concrete steps.