Governance · Privacy and data governance · 03
GDPR and CCPA readiness
GDPR and CCPA readiness prepares an organization to meet the obligations of the European and California privacy regimes, and the state laws modeled on them, that apply to the personal data it holds: lawful bases and notices, individual rights handling, records of processing, data protection assessments, vendor contracts, cross-border transfers and breach notification. It is needed when the organization serves customers or employs staff in those jurisdictions, when a customer contract flows down the obligations, when a rights request arrives and no process exists, or when a regulator or customer asks for evidence. Readiness produces a scope determination of which laws apply and to what, a gap assessment against each obligation, the notices, procedures and contract terms required, and the evidence that the program operates.
Scope
What the review covers.
- Applicability: which laws apply, to which data and activities
- Lawful bases, notices and consent where required
- Individual rights: access, deletion, correction, opt-out, with procedures and timelines
- Records of processing and data protection assessments
- Vendor contracts and cross-border transfer mechanisms
- Breach notification procedures and evidence
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Applicability determination | Which regimes apply and how |
| Gap assessment | Obligation by obligation with evidence |
| Procedure and notice set | Rights handling, notices, assessments |
| Evidence pack | For regulators and customers |
Prerequisites
What we need from you.
- The data inventory and mapping, or agreement to build it first
- Knowledge of customer, employee and website user populations by jurisdiction
- Counsel to confirm legal determinations
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Do US companies really need to worry about GDPR?
If they offer goods or services to people in the EU or monitor their behavior, yes. The applicability determination settles the question with evidence.
Can one program cover several state laws?
Largely. The laws share structure. Readiness builds to the strictest applicable requirement and documents the differences.
Do you provide legal advice?
No. Counsel does. We build the operational program and the evidence; counsel confirms the legal determinations.