Healthcare
Specific to this sector
- Additional safeguards for special category data
- Per-person traceability of access to patient records
Outcome
Role-based access to patient data, traceable records and correctly structured explicit consent.
Packages
Ways of working and sector packages
Three ways of working give you a starting point based on the size of the work. Sector packages add the items your sector needs first on top of the shared baseline.
Ways of working
Three ways to work
Three starting points depending on the size of the need. All run on the same five-phase model; what changes is scope and continuity.
Starter
To see where you stand and take the first steps. Short, with a defined end.
PriceDetermined by scope
Who it is for
Organisations new to compliance that want an assessment first.
Scope
- Current state analysis and priority ordering
- Producing the first version of the data inventory
- Preparing privacy notice and explicit consent texts
- Assessing the VERBIS obligation
- Roadmap and indicative schedule
- Most often chosen
Compliance programme
End-to-end implementation: from inventory to disposal, from policy to technical measure. Leaves an audit-ready arrangement.
PriceDetermined by scope
Who it is for
Organisations that want to meet the KVKK and/or ISO 27001 obligation in full.
Scope
- Everything in the Starter package
- Retention periods, disposal policy and periodic disposal setup
- Establishing data subject request and breach processes
- Risk assessment and putting technical measures into operation
- Organising access rights and establishing the logging arrangement
- Document set, internal audit and audit readiness
- Product deployment and integration where needed
Continuous support
Periodic support so the arrangement keeps running. Compliance is not a one-off job.
PriceDetermined by scope
Who it is for
Organisations that have finished implementation and struggle to sustain it internally.
Scope
- Periodic review and status report
- Tracking legislative changes and assessing their impact
- Support in responding to data subject requests
- Access review and pre-audit preparation
- Response support during a breach
- Optional: external data protection officer
Price
We do not publish a price list. Price follows the number of systems, the number of units, the standard chosen and whether a product is used. A figure given without seeing the scope misleads one of the two sides; the initial assessment is free.
Sector packages
Scope shaped by your sector
The same obligations press from a different place in each sector. Sector packages add the items that come first there on top of the shared baseline.
In every package
- Data inventory and record of processing activities
- Privacy notice and explicit consent texts
- Retention periods and disposal policy
- Data subject request process
- Periodic review
Finance and fintech
Specific to this sector
- Third-party sharing agreements
- Access and logging matrix
Outcome
Financial data in an audit-ready structure with written grounds and traceable access.
Insurance
Specific to this sector
- Special category data controls
- Agent and adjuster sharing agreements
Outcome
Separated retention for policy and health data, with auditable sharing.
E-commerce
Specific to this sector
- Cookie and marketing consent management
- Minimisation in order and membership data
Outcome
Provable cookie consent, separated marketing permission and documented transfers.
Education
Specific to this sector
- Additional safeguards for children's data
- Parent and student notice flows
Outcome
Correct notice for student data, manageable consent and a defined retention period.
Public sector
Specific to this sector
- Inter-institutional sharing protocols
- Large-scale access management
Outcome
Citizen data with purposes mapped to the mandate, written sharing grounds and traceable access.
Manufacturing
Specific to this sector
- Supplier and processor agreements
- Access separation between operational and corporate networks
Outcome
Separated access across field and office, and supply chain sharing put under contract.
Logistics
Specific to this sector
- Location and vehicle tracking data policy
- Minimisation of sender and recipient data
Outcome
A defined retention period for location data and contracted sharing with subcontractors.
Tourism and hospitality
Specific to this sector
- Identity and passport data security
- Rules for transfers involving foreign guests
Outcome
Short retention for identity data, transfers with written grounds, and access closed at season end.
Telecommunications
Specific to this sector
- Traffic and location data policy
- Large-scale access security
Outcome
A workable retention arrangement for high-volume data and a request process that scales.
Energy
Specific to this sector
- Access security for field control systems
- Subscriber and meter data policy
Outcome
Separated access across critical infrastructure and a continuity plan tested by drill.
Construction
Specific to this sector
- Site access record arrangement
- Subcontractor data sharing agreements
Outcome
A data arrangement with written grounds across site and subcontractors, closing at project end.
Media and publishing
Specific to this sector
- Targeting and measurement consent management
- Minimisation of subscriber data
Outcome
A separated pool for subscriber data, traceable cookie consent and a request process that scales.
Automotive
Specific to this sector
- Connected vehicle and telemetry data management
- Consent flows in dealer and service systems
Outcome
Customer data managed from one place across the dealer network, with telemetry purposes defined.
A sector package is a starting scope, not a fixed list. After the discovery phase we set the scope together, based on your organisation.
See where you stand in 20 minutes
The free initial assessment maps your current state and tells you which step should come first. You are not committed to anything afterwards.
Look at it yourself first
A twenty-five question KVKK compliance test with per-area scores and a priority recommendation. No sign-up.
Start the compliance testLet's look together
We discuss your current state and work out which step comes first and how long it takes.
Request a conversation