How long does it take to achieve GDPR compliance?

The timeline depends on your organization's size and current state. For most mid-size organizations, a GDPR compliance program can be implemented in 3-6 months. We start with a 48-hour gap assessment to identify priorities and deliver an actionable 90-day roadmap.

Does my organization need to comply with NIS2?

NIS2 applies to essential and important entities in sectors such as energy, transport, healthcare, finance, digital infrastructure, and manufacturing. Organizations with 50+ employees or over EUR 10M turnover in covered sectors are typically in scope. We offer a free NIS2 applicability check.

What does a compliance consultation include?

Our free 30-minute initial consultation covers: assessing your current compliance state, identifying the regulations that apply to your organization, outlining 90-day priorities, and providing a high-level roadmap. There is no obligation to proceed after the consultation.

Do you provide outsourced DPO services?

Yes. We offer outsourced Data Protection Officer (DPO) services as required by GDPR Article 37. Our DPO service includes regulatory monitoring, data subject request handling, DPIA oversight, staff training, and serving as the contact point for supervisory authorities.

Which industries do you serve?

We work with organizations across healthcare, financial services, technology and AI, energy, telecommunications, retail, transport, and manufacturing. Our consultants hold industry-specific certifications including CIPP/E, CIPM, and CISM.

EUROPEAN COMPLIANCE ADVISORY · EST. 2020

EU compliance advisors.

GDPR. NIS2. AI Act. DORA. We map your obligations, build the controls, and run them with you. Audits pass. Operations continue.

Free NIS2 check

TRUSTED BY ↘

RocheSiemensAstraZenecaInditexKončarOrbicoFortenovaEwopharmaBauerfeindTawal

01 / WHAT WE COVER

EU compliance services.

We cover the EU regulatory stack end-to-end: GDPR, NIS2, AI Act, DORA, AML, MiFID II, ePrivacy, CSRD and EU regulatory compliance broadly. Below are the four practices most clients lead with; the rest sits in the same engagement, with the same partner.

DPR01/04

↗

GDPR & Data Protection

·Gap assessment and 90-day remediation plan
·Outsourced DPO, DPIAs, ROPA, DSAR handling
·Breach response and supervisor liaison

View service →→

CYB02/04

↗

NIS2 & Cybersecurity

·Scoping: essential vs. important entity
·Risk framework, policies, board reporting
·Incident playbooks and ENISA-aligned reporting

View service →→

AIC03/04

↗

EU AI Act

·System inventory and risk classification
·Conformity files, transparency, human oversight
·Governance for high-risk and GPAI deployments

View service →→

FIN04/04

↗

DORA & Financial Compliance

·ICT risk management and resilience testing
·Third-party register and contract remediation
·MiFID II, AML/KYC, banking obligations

View service →→

ALSO COVERED ↘

ePrivacyCSRD / ESGAML / KYCMiFID IIPSD2eIDASCyber Resilience ActData ActData Governance ActWhistleblowing DirectiveDigital Services ActDigital Markets ActProduct liabilitySector-specific advisory

02 / METHODOLOGY

The Vision Method.

A four-phase, evidence-based process. Each phase has named deliverables, defined timelines, and an executive review gate before proceeding.

ASSESS01/04

Assess

48-hour gap assessment against applicable regulations. Maturity baseline, control gaps, and prioritised risk register.

DELIVERABLES→Gap report→Risk register→Maturity score

Weeks 1-2

DESIGN02/04

Design

Compliance roadmap with sequenced workstreams, owners, dependencies, and budget. Approved by the executive sponsor.

DELIVERABLES→90-day roadmap→RACI matrix→Budget plan

Weeks 3-4

IMPLEMENT03/04

Implement

Hands-on execution: policies, controls, DPIAs, vendor reviews, technical safeguards, training. Weekly progress reviews.

DELIVERABLES→Policy stack→DPIAs→Trained staff

Weeks 5-20

OPERATE04/04

Operate

Run-rate compliance: incident response, regulatory tracking, audit support, board reporting. Retainer or in-house handover.

DELIVERABLES→IR runbook→Quarterly review→Audit packs

Ongoing

03 / SELECTED WORK

Selected outcomes.

All case studies →

CASE 01PHARMA · 4,000 STAFF

GDPR audit: zero findings.

FINDINGS

4 mo

DELIVERED

€3.2M

EXPOSURE AVOIDED

SCOPEGDPR · DPIAs · DPO-as-a-Service

CASE 02TIER-2 EU BANK

DORA live across 11 critical ICT functions.

ICT FUNCTIONS

6 mo

DELIVERED

147

VENDORS REVIEWED

SCOPEDORA · NIS2 · Incident reporting

CASE 03AI SCALE-UP · SERIES C

AI Act conformity for 7 production models.

MODELS

HIGH-RISK FILINGS

Yes

LAUNCH HELD

SCOPEAI Act · GDPR · Model governance

04 / IN NUMBERSUPDATED Q2 2026

300+

Engagements delivered

8 sectors

EU jurisdictions

Direct delivery

48 h

Time to first roadmap

From scoping call

Material findings

Across client audits

TESTIMONY ↘

“Roadmap in week one. DPO function live in month two. Passed the DPA audit with zero findings. The only advisors we've worked with who actually run the controls instead of writing about them.”

IT Director

Large Pharma

05 / INDUSTRIES

Sector practices.

Specialised practices for regulated industries.

HC↗

Healthcare

Patient-data GDPR, NIS2 for hospitals, MDR-adjacent IT controls.

FS↗

Financial Services

DORA implementation, MiFID II, AML/KYC, supervisor reporting.

AI↗

Technology & AI

AI Act conformity, GDPR for ML, GPAI provider obligations.

EN↗

Energy

NIS2 essential entity scoping, OT/IT segmentation, incident drills.

TC↗

Telecommunications

NIS2, ePrivacy, lawful intercept, operator obligations.

RT↗

Retail

GDPR for marketing, cookie consent, PSD2, payments security.

TR↗

Transport

NIS2 for air, rail and maritime; supply-chain resilience.

MF↗

Manufacturing

NIS2 for critical manufacturing, OT security, IIoT controls.

06 / HOW WE WORK

Six ways to engage.

Pick the engagement model that fits the scope. Every model has a fixed price and a signed scope letter before kick-off.

CAAS↗

Compliance-as-a-Service

Your outsourced compliance function. Monthly retainer, named team, runs the programme.

BEST FITNo in-house function

DPO↗

DPO-as-a-Service

Outsourced Data Protection Officer named to your supervisory authority.

BEST FITGDPR Art. 37 obligation

PROJ↗

Programme Delivery

Fixed scope, fixed fee, fixed deadline. NIS2, AI Act, DORA, GDPR remediation.

BEST FITRegulatory deadline

AUDIT↗

Audit & Assurance

Independent gap assessment or pre-supervisory readiness review.

BEST FITM&A or pre-audit

ADV↗

On-Call Advisory

Pay-as-you-go senior partner time. Strategic calls, board prep, regulator queries.

BEST FITTeam in place, needs backup

TRN↗

Training & Workshops

GDPR, NIS2, AI Act for boards, engineering, marketing. On-site or remote.

BEST FITAwareness obligations

STEP 01

30-min call

Free, no commitment

STEP 02

48-h roadmap

Priorities, scope, fee

STEP 03

Signed scope

Fixed fee, signed scope

STEP 04

Live in 2 weeks

Named team, weekly cadence

CREDENTIALS & POSTURE ↘

IAPP

MEMBER FIRM

ENISA

EXPERT ROSTER

ISO 27001

INTERNALLY CERTIFIED

ISO 27701

INTERNALLY CERTIFIED

CIPP/E

CERTIFIED ON TEAM

CISA

CERTIFIED ON TEAM

GDPR

AZOP REGISTERED

CONFIDENTIAL FROM DAY ONE

STANDARD ENGAGEMENT

07 / WHY VC

Why teams hire us.

Senior-led

Every engagement runs through a partner. The person who scopes the work delivers it.

Multi-regulation

GDPR, NIS2, AI Act, DORA, AML, MiFID II. One team, one evidence stack.

Operational delivery

Named DPO, DSAR queue, breach response, supervisor liaison. Day-to-day execution by our team.

Audit-ready evidence

Every control traces to a citation and a test. Built to survive supervisory review.

08 / INSIGHTS

Latest analysis

All articles →

Compliance22 MIN

2026.03.28

Best EU Compliance Firms Guide

Best EU compliance firms guide: compare GDPR, NIS2, DORA and AI Act advisory providers by expertise, pricing, delivery model, credentials, and fit.

Read article →

Data Protection23 MIN

2026.03.28

How to Choose a GDPR Consultant

Evaluate GDPR consultants with criteria for expertise, pricing, DPO support, DPIAs, audit readiness, EU coverage, red flags, and provider fit.

Read article →

Compliance22 MIN

2026.03.28

Compliance as a Service Guide

Compliance as a Service guide for GDPR, NIS2, DORA and AI Act: scope, pricing, provider selection, managed compliance models, and risks.

Read article →

09 / FAQ

Frequently Asked Questions

We provide advisory services across all major EU regulatory frameworks including GDPR, NIS2 Directive, EU AI Act, DORA, MiFID II, AML directives, ePrivacy, and CSRD. Our team covers the full spectrum of compliance requirements for organizations operating in the European Union.

10 / GET STARTED

Get your compliance roadmap in 48 hours.

30 minutes with a partner. You leave with: where you stand against GDPR, NIS2, AI Act and DORA, the three things to fix first, and a fixed-fee proposal if you want one.

NO COMMITMENT·CONFIDENTIAL·SENIOR ADVISOR