GDPR Consulting for Companies
Fidem supports companies on the path to compliance with the EU General Data Protection Regulation 2016/679 (GDPR). Unlike pure legal advice, Fidem brings technical cybersecurity skills to ensure that data is really protected: from vulnerability analysis to the operational handling of data breaches, up to the certified external DPO service.
GDPR in 2026: What It Really Requires from Companies
The EU Regulation 2016/679 (GDPR) places precise obligations on public and private organizations that process personal data, covering governance, technical and organizational security, and the handling of personal data breaches.
In 2026 the picture has evolved: data protection authorities have stepped up their checks, and convergence with related regulations (NIS2 first of all) has made documentation-only compliance insufficient. Companies that have not implemented real technical measures, such as encryption, access control, log management and vulnerability assessment, risk fines and liability in the event of an incident.
GDPR fines can reach 4% of annual global turnover or 20 million euros (whichever is higher), with direct liability for the controller and the processor.
The Technical Measures Required by Art. 32 GDPR
Art. 32 GDPR requires technical and organizational measures appropriate to the risk of the processing. It is not a generic obligation: the regulation specifies the categories of measures required. Fidem implements them operationally for every client:
- Pseudonymization and encryption of data: end-to-end encryption for sensitive data in transit and at rest.
- Confidentiality, integrity and availability: a security architecture that ensures secure processing with tested business continuity.
- Ability to restore: managed backups and documented, tested disaster recovery procedures.
- Effectiveness of the measures: periodic Vulnerability Assessments to verify that the technical measures adopted are actually effective against current threats.
- Traceability of system administrators: complete, tamper-proof and verifiable access logs, as required by the Italian Data Protection Authority’s provision on system administrators, with Custos.
Data Breach Handling: 72 Hours to Notify the Authority
Art. 33 GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to put the rights of data subjects at risk. Without active monitoring, many companies discover breaches days or weeks late, when they are already in breach of the rule.
Fidem manages the entire incident response cycle:
- Early detection through Defensio SOC with 24/7 monitoring of security events.
- Immediate containment of unauthorized access and isolation of compromised assets.
- Complete evidential documentation to support the company’s legal counsel in the notification to the authority.
- Notification to data subjects as required by Art. 34, with compliant templates and dispatch logs.
External DPO: Mandatory for Public Bodies, Healthcare and Large-Scale Processing
The Data Protection Officer (DPO) is mandatory for public authorities, for organizations that process special categories of data on a large scale (health, biometrics, criminal records) and for those that carry out large-scale systematic monitoring of data subjects.
Fidem offers an external DPO service with a professional who combines legal expertise in data protection law with technical cybersecurity skills, a rare combination on the market that gives you a DPO who understands both the regulation and the client’s IT infrastructure.
The service includes: supervision of the record of processing activities, prior advice on DPIAs (Data Protection Impact Assessments), contact point with the supervisory authority, and continuous updates on new EDPB guidance.
GDPR Gap Analysis: Where to Start
The GDPR compliance path with Fidem starts with a Gap Analysis that maps the organization’s current situation against the requirements of the regulation:
- Inventory of processing activities: we identify every process that handles personal data, internal, outsourced or shared with third parties, and build or update the Record of Processing Activities.
- Analysis of legal bases: we check that every processing activity has a valid legal basis (consent, contract, legal obligation, legitimate interest).
- Technical assessment of Art. 32 measures: we verify with technical tools (not just interviews) the security measures actually implemented: encryption, access, logs, backups.
- Prioritized remediation plan: we produce a plan with corrective actions ordered by risk and ease of implementation, with cost and time estimates.
Why Choose Fidem and Not Just a Law Firm
GDPR consulting in 2026 is a crowded market. Law firms produce documents; the large consulting firms (the Big Four) cost amounts beyond the reach of SMEs. Fidem is positioned differently:
- Integrated technical expertise: we do not just know what Art. 32 says, we know how to implement it technically: encryption, access control, SIEM, backups, VAPT. GDPR is a technical problem too, not only a legal one.
- Real breach detection: the obligation to notify within 72 hours requires active monitoring. Fidem provides it through Defensio SOC, not through a Word template.
- A DPO with a technical background: a DPO who understands both the regulation and the IT infrastructure is rare and valuable. Fidem trains and provides DPOs with this dual expertise.
- SME scale: our approach is sized for small and mid-sized companies, with transparent fees and without the overheads of the large consulting firms.
Frequently Asked Questions about GDPR Consulting
Do SMEs have to comply with the GDPR?
Yes. The GDPR applies to any organization, regardless of size, that processes personal data of individuals in the EU. There is no size threshold: even a small business with a single employee or customer is subject to the basic obligations of the regulation.
When is it mandatory to appoint a DPO?
Appointing a Data Protection Officer is mandatory for: (1) public authorities and bodies, (2) organizations that carry out large-scale processing of special categories of data (health, biometrics, judicial data), (3) organizations that carry out large-scale systematic monitoring of data subjects. Fidem assesses whether the appointment is mandatory at no cost during the preliminary Gap Analysis.
What happens if I suffer a data breach and do not notify the authority?
Notification to the supervisory authority within 72 hours is mandatory when the breach is likely to put the rights of data subjects at risk. Failing to notify is a separate GDPR infringement, punishable by up to 4% of annual global turnover or 20 million euros (whichever is higher). The risk is twofold: the fine for the breach plus the fine for the missing notification.
How long does a GDPR compliance project take?
It depends on the complexity of the organization and its current maturity. On average the Gap Analysis takes 2-4 weeks; implementing the corrective measures and drafting the complete documentation takes 2-6 months. Fidem produces a compliance plan with priorities and a tailored timeline already in the first assessment phase.
What is a DPIA and when is it mandatory?
A DPIA (Data Protection Impact Assessment) is a formal analysis of the risk that high-risk processing may pose to the rights of data subjects. It is mandatory when biometric data is processed on a large scale, when systematic profiling is carried out, when public areas are monitored or when automated decisions with significant effects on people are adopted.
Start with a GDPR Gap Analysis
Contact us for a preliminary assessment of your GDPR compliance. Our experts analyze the current situation, identify the priority gaps and present a concrete action plan sized to your organization.
GDPR Consulting from Verona for Companies in Italy and the EU
Our operational headquarters are in the province of Verona, Italy: for companies nearby, GDPR consulting can also take place on site, with audits, training and meetings with management. Everywhere else we work remotely with the same coverage: external DPO, records and impact assessments, data breach handling.
If your company also falls within NIS2 scope, it pays to handle the two obligations together: the technical measures largely overlap.
How much does GDPR consulting cost?
It depends on how many processing activities have to be mapped and how far the starting point is, not on the number of employees. A small company processing health data needs more work than a large one with ordinary processing. The variables: number of processing activities and of suppliers to regulate, presence of special categories of data, whether a DPO is also needed, and whether compliance starts from zero or from an existing base.
Where to start
From the record of processing activities, always. It is not bureaucracy: it is the inventory without which you know neither what to protect nor what to declare. Privacy notices, legal bases, appointments of external processors and technical measures all follow from it.
GDPR and NIS2: do they overlap?
No, and confusing them doubles the work. GDPR protects personal data; NIS2 protects the continuity of services. A company can be subject to both, with different obligations and notification deadlines. The technical measures, however, overlap widely: done well once, they count for both.
What is NOT included
Consulting does not replace legal advice on an ongoing dispute, and compliance is not a certificate: it is a state that has to be maintained. Technical measures then have to be verified: that is the job of the vulnerability assessment, not of the documentation. Terms in the glossary.
Where we work
Most of the compliance work is done remotely, with shared documents and regular meetings: we work with companies across Italy and the EU. In Verona and North-East Italy kick-off sessions and reviews can take place on site.
Definitions: data breach · DPO in the cybersecurity glossary.