What you get
- Records of processing activities (controller and processor) always up to date
- Privacy notices for each category of data subject
- DPIA and LIA for high-risk processing
- DPO designation, published on the website and notified to the Authority
- Operating procedures for data breaches and data subject rights
- IT infrastructure risk assessment plus remediation plan
- ACSIA CRA software for active monitoring
- Training of staff authorised to process data
Technological developments, new models of economic growth and an ever greater need to protect personal data are the reasons behind the adoption of the European Regulation on data protection (GDPR). The development of information technology also calls for a careful assessment of information security.
Privacy package
- Initial audit of processing activities, mapping of information systems, interviews with internal managers.
- Records of processing under Article 30 in editable form, with the mandatory six-monthly review.
- Privacy notices customised for employees, customers, suppliers, applicants, website visitors and newsletter contacts.
- DPIA for high-risk processing: video surveillance, geolocation, profiling, health data, biometrics.
- Written procedures for data breaches, the exercise of data subject rights and the appointment of external processors.
External DPO
For organisations required to appoint a DPO, we provide an external Data Protection Officer with ongoing consultancy: point of contact for data subjects and the Authority, opinions on DPIAs, periodic audits, staff training.
Cyber Security
Forgest has a team of consultants specialised in cybersecurity, able to:
- identify threats, vulnerabilities and risks relating to data protection and IT assets;
- design a documented system capable of evidencing compliance with the rules of the sector;
- support the company in responding to incidents and in reducing residual risk;
- draw up operating policies and disaster recovery plans.
ACSIA CRA software
Alongside the consultancy, we distribute ACSIA CRA, active protection software that monitors the company infrastructure, detects anomalous behaviour in real time and blocks threats before they spread. Consultancy plus technology combined in a single service.
Data breach
In the event of a breach we assist with the risk assessment, with the notification to the Authority within 72 hours (Article 33 GDPR) and, where necessary, with the communication to the data subjects (Article 34). We provide a breach register and a post-event analysis.
Regulatory reference
Regulation (EU) 2016/679 (GDPR), Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, NIS2, measures of the Italian Data Protection Authority, ISO 27001.
Case Study
See a real case where we applied this service area.