Consulting
Security and GDPR technical review
A security and GDPR review is a technical check of how your website or software protects the personal data it collects. It is for any business holding data about customers, patients, candidates or service users. You receive a prioritised list of weaknesses, a map of data flows and a review of cookies and consent; legal advice remains the work of lawyers.
The technical side of data protection
The GDPR calls for appropriate technical measures to protect personal data, but doesn't say which ones. In practice, the most common problems are simple: outdated plugins, former employees' accounts still active, forms that e-mail personal data for no reason, backups that have never been tested, advertising cookies set before anyone has agreed. A review finds these weaknesses before someone else does.
Knowing where the data goes
Even a simple website can send data to many services: hosting, e-mail, analytics, chat, newsletters, payments. We trace that journey system by system, noting the type of data and the country each service is based in. With the map in hand, your business can answer when a customer asks what happens to their data, and your lawyer has the groundwork they need.
What we check
- Versions, updates and security settings
- Accounts, permissions and two-factor authentication
- Forms, attachments and e-mails carrying personal data
- Cookies, consent and third-party services
- Backups and recovery
- AI assistants and what they do with conversations
Fixing in the right order
The report separates what is urgent from what can be planned. Many fixes take hours; others need bigger changes to the software. If the system turns out to be in worse shape than it seemed, project rescue handles the recovery. For a broader look at architecture and code, see the software and architecture audit.
What you get
- A technical security check of the website, application and hosting
- A review of access rights, passwords, two-factor authentication and old accounts
- A personal-data map showing where data comes in, where it is stored, who can see it and where it goes
- A check of cookies, the consent banner and the consent log
- A review of forms, outgoing e-mails and the third-party services in use
- A check of backups and the recovery plan
- A technical report with weaknesses and fixes in order of priority
Best for
- Clinics and practices handling health data
- Firms that keep client documents and personal details
- Online stores and platforms with customer accounts
- Companies about to answer a large customer's security questionnaire
Typical features and modules
Communication & leads
- E-mail deliverability
Payments & sales
- Fraud prevention & 3-D Secure
AI add-ons
- AI transparency & logging
Compliance & security
- GDPR pack
- Security hardening
- Consumer-law essentials
Hosting, e-mail & maintenance
- Monthly maintenance
How we deliver it
A conversation to agree which systems to review and what worries you
Read-only access to the website, application, hosting and relevant accounts
Technical checks and mapping of personal-data flows
A report with weaknesses, risks and fixes in order of priority
A walkthrough session and, if you want it, help with the fixes
Frequently asked questions
Does this replace a lawyer or a data protection officer?
No. We cover the technical side, meaning how your systems collect, store, protect and share data. Legal questions, such as lawful bases, contracts or dealing with the data protection authority, stay with lawyers. Our report gives them accurate technical information to work from.
Is this a penetration test?
It is not a full penetration test. We check configurations, versions, access rights and the most common web weaknesses, without trying to exploit the system aggressively. If your situation calls for a formal penetration test, we tell you and explain what to ask for.
Can the data map be used for our record of processing activities?
As a technical foundation, yes. It shows what data each system holds, where it is sent and who can access it. The record itself should be completed with whoever handles the legal side.
Is our cookie banner compliant?
We check that non-essential cookies are only set after consent, that refusing is as easy as accepting and that choices are logged. We also confirm that what the banner says matches what the site actually does.
Will you see our customers' data?
Only the minimum needed, and we would rather see none. We work with read-only access and, wherever possible, in an environment without real data. Before we start, we agree in writing what we may look at.
How much does it cost?
Every project is quoted by hand from your requirements, so pricing is on request. Tell us which systems you use and what kind of personal data you hold. Request a quote
Shall we talk about your project?
Tell us what you have in mind and what you want to achieve.