Am I GDPR compliant

GDPR has been in force since 2018, but many small and medium businesses still do not know exactly what they need to do or what they are already doing right. Compliance is not a binary state: it is a level of risk you choose to manage. A first assessment helps identify the points that actually matter for your activity, without getting lost in a list of abstract obligations.

What the assistant does

The assistant asks you the key questions to build a quick picture of where you stand.

What data do you collect? The type of data (name, email, health data, financial data) determines the level of obligation. The assistant helps you map the data you collect, where it is stored, and how long you have been keeping it.

Do you have a legal basis for each processing activity? Consent, contract, legitimate interest: every data processing activity needs an identified legal basis. The assistant helps you qualify the main processing activities in your business.

Are your sub-processors compliant? If you use cloud tools (CRM, email marketing, accounting software), you are sharing data with sub-processors. The assistant works through with you whether data processing agreements are in place and whether your tools are hosted in the European Union or carry the required safeguards.

Are your privacy notice and cookie policy up to date? The assistant reviews the mandatory elements that must appear on your website or in your communications, and flags any gaps.

When an expert takes over

An iokoo DPO consultant or data protection officer goes deeper on the work.

They produce a full record of processing activities, draft or update your privacy policy and legal notices, formalize any missing data processing agreements, and guide you through bringing your most sensitive processing activities into compliance. If a notification to the relevant data protection authority is needed, they coordinate the process.

See our expert pool page to learn more about the available consultants.