GDPR gap analysis
We assess your current situation against GDPR obligations and expose where the biggest gaps and risks are — with priorities that are actually workable.
← All services
Privacy
GDPR Consultancy
Privacy legislation translated into concrete processes and technical measures that people actually use.
Why this matters
Privacy is not a formality — it is a legal obligation.
The moment you process personal data — from customer and patient records to employee and CCTV data — you are legally required to manage it carefully, securely and demonstrably. The GDPR applies to virtually every organisation, regardless of size. Non-compliance is not a theoretical risk: the Dutch Data Protection Authority can impose fines of up to €20 million or 4% of global annual turnover, and a data breach can — on top of that fine — lead to reputational damage, claims and loss of trust among customers and supply-chain partners.
Tactical Support translates this legislation into concrete processes and technical measures you can use every day — so that compliance does not end up in a drawer, but demonstrably works.
The legal basis Framework
Your obligations do not come from a single source, but from a coherent set of European and Dutch legislation:
- GDPR — the General Data Protection Regulation (EU 2016/679); the core of all privacy obligations.
- Dutch GDPR Implementation Act (UAVG) — the national implementation of the regulation.
- NIS2 / Cybersecurity Act — mandatory security and reporting measures for essential and important entities, directly linked to data protection.
- Sector rules — such as healthcare standards (e.g. NEN 7510), where additional requirements apply.
What the law requires Duty
The GDPR imposes demonstrable obligations. The most important ones for your organisation:
- A lawful basis for every processing activity (Art. 6 GDPR).
- An up-to-date processing register (Art. 30 GDPR).
- Appropriate technical and organisational security (Art. 32 GDPR).
- A DPIA for high-risk processing (Art. 35 GDPR).
- Breach notification within 72 hours (Art. 33 GDPR).
- Safeguarding data-subject rights: access, rectification and erasure (Art. 15–22 GDPR).
Accountability (Art. 5(2) GDPR): you must not only comply with the GDPR, but also be able to demonstrate it. Without documented processes, registers and measures, compliance is not legally defensible — which is exactly what our approach targets.
What we deliver
Processing register
An up-to-date register of all your processing activities with purposes, legal bases, recipients and retention periods — the legally required foundation (Art. 30) everything rests on.
DPIA support
For high-risk processing we guide the mandatory Data Protection Impact Assessment, from assessment through to control measures.
Retention & policy
Documented policy on how long data may be kept and when it is destroyed — so you never retain data unnecessarily or for too long.
Breach response
A workable playbook for detection, assessment and notification within the legal 72-hour window, including communication to data subjects and the supervisory authority.
Privacy by design & by default
Privacy built in from the drawing board into systems and processes (Art. 25), making data protection the default rather than an afterthought.
The result
Demonstrable control over personal data, lower risk and workable privacy.
Tactical Support can advise, implement and remain involved for management and continuous improvement. Scope and responsibility are agreed before work starts.
Direct specialist contact
Short lines without an anonymous help desk.
Business continuity first
Changes are planned around operational impact and recovery.
Clear documentation
Decisions, changes and ownership remain understandable.
Frequently asked questions
Questions about GDPR Consultancy
What does GDPR Consultancy include?
The service is tailored to your environment and can include . Scope, responsibilities and handover are agreed in advance.
How does a GDPR Consultancy engagement start?
We start with your operational context, dependencies and risks. You then receive clear choices, a practical plan and documented delivery.
Where does Tactical Support provide this service?
Tactical Support is based in Tiel and supports organisations throughout the Netherlands, remotely and on site by agreement.
Demonstrable control over personal data, lower risk and workable privacy. Available to organisations throughout the Netherlands.
Ready for a tactical next step?
Tell us what is going on. We will gladly think along, without obligation.