Which privacy laws apply to us?

It follows the people whose information you hold, so a company anywhere in Canada that serves customers in Quebec is inside Law 25, and one with users in Europe is inside the GDPR. PIPEDA applies federally to commercial activity, and several provinces have their own statutes for health information. The scoping read settles which of these reach you and which do not, in writing, so the program is built once against the real set. Truvo is not a law firm and this is not legal advice. Where an obligation turns on a genuinely contested reading, the assessment says so and names it for your counsel instead of guessing.

We already hold SOC 2 or ISO 27001. How much of a privacy program is already built?

More than most teams expect on the security half, and less than they expect on the rest. Access control, encryption, logging, vendor management and incident response already produce most of the safeguard evidence a privacy regulator would look for, filed under a control number instead of a section number. What those frameworks do not produce is the inventory of what personal information you hold and why, the lawful basis or consent record behind each use, retention rules that are enforced instead of stated, and the workflow for answering an individual who asks for their data. The gap analysis marks which rows are done and which are the real work.

Law 25 requires a privacy officer. Is that what this is?

No, and the two are worth keeping apart. Law 25 requires that the role be designated, defaulting to the person with the highest authority unless it is delegated in writing, and PIPEDA requires an accountable individual as well. That is a standing role someone has to hold. This service is the assessment work: finding out where you stand and what has to change. If the outcome is that no one in the company can hold the role, Truvo offers it separately as an ongoing engagement.

Is a privacy impact assessment part of this, or a separate thing?

It is part of it, and under Law 25 section 3.3 it is mandatory for any project that acquires, develops or overhauls a system handling personal information, with the privacy officer involved from the start. Truvo runs those assessments as part of the engagement and leaves behind the register that shows the process exists, since a single completed document does not demonstrate one. Teams that want to run the first one themselves can start from the template Truvo publishes, which includes the crosswalk from each safeguard to the SOC 2 and ISO 27001 controls already covering it.

Do you take copies of our data to run the assessment?

No. The inventory and the data flow mapping are built from your systems, your documentation and interviews with the people who operate them, working inside your environment. Truvo does not take custody of, store, or host your production data or the personal information inside it in order to assess how it is handled. On an engagement about privacy that answer matters more than usual, and it is one your own customers are increasingly asking you for in vendor review.

GDPR Consultant: GDPR Compliance Services

Our team's experience includes projects with

What a GDPR engagement covers

Find out which GDPR obligations reach you, then build the privacy program on the security controls you already run.

Scoping read

Whether the GDPR applies under Article 3, and your role as controller, processor or both for each processing activity. In writing.

Records of processing

Article 30 records built from a data inventory and data flow map of your real systems.

Lawful basis and DPIAs

Lawful basis for each purpose under Article 6, and data protection impact assessments under Article 35 for high-risk processing.

Contracts and EU data transfers

Article 28 data processing agreements, and a transfer mechanism for every flow out of the EU: the EU-US Data Privacy Framework, the Canada adequacy decision or Standard Contractual Clauses.

Rights requests and breach response

A workflow for access, correction and deletion requests under Articles 15 to 22, and breach notification inside the 72-hour window of Article 33.

Article 32 mapped to your existing controls

Security of processing mapped to the SOC 2 criteria and ISO 27001 controls that already produce the evidence.

Assess, Build, Operate, applied to the GDPR

A documented methodology, led by a senior CISSP in the US or Canada with 10+ years in security.

01

Assess

Article 3 scoping, data inventory, data flow map and gap analysis, built from your systems and interviews inside your environment.

02

Build

Records of processing, DPIAs, data processing agreements, transfer mechanisms and the rights request workflow.

03

Operate

Truvo runs the privacy processes every month as part of managed compliance, alongside SOC 2 or ISO 27001. A fractional privacy officer is available when a DPO is required.

What you hold at the end

A GDPR program built on the security controls you already operate.

Book a strategy call

GDPR applicability and role determination, in writing
Records of processing activities (Article 30)
Data flow and EU transfer map
DPIA register and process
Data processing agreements (Article 28)
Control mapping to SOC 2 and ISO 27001
Rights request and breach notification workflows
Questionnaire answer set

What changes with a GDPR program

European customers get GDPR answers backed by records and running processes.

You know where the GDPR reaches you

Decided under Article 3 for each product, with your controller or processor role named.

Security evidence does double duty

SOC 2 and ISO 27001 evidence covers Article 32 security of processing, filed under a different number.

Every EU data flow has a transfer mechanism

The Data Privacy Framework, an adequacy decision or Standard Contractual Clauses, assigned flow by flow.

European deals keep moving

Procurement teams get the DPA, the records of processing and written answers to the GDPR section of their questionnaire.

Who GDPR consulting is for

Truvo Cyber is a cybersecurity consulting firm. Where an obligation turns on a contested legal reading, the assessment names it for your counsel.

Right call when

You hold personal data about people in the EU
A European customer or partner has asked for GDPR evidence or a data processing agreement
You hold SOC 2 or ISO 27001 and want to know how far it carries into the GDPR
Personal data leaves the EU and each flow needs a transfer mechanism

Wrong call when

You need legal advice on a specific obligation, so bring your counsel and we work beside them
You need an EU representative under Article 27, which must be established in the EU
You hold no personal data about people in the EU

Frequently asked questions

Does the GDPR apply to a company outside the EU?

The GDPR follows the people. Article 3 brings a company based in Canada or the US inside the regulation when it offers goods or services to people in the EU or monitors their behaviour there. A SaaS company with European users or an app available in the EU is usually in scope. The scoping read settles the answer for each product in writing, and identifies whether you also need an EU representative under Article 27.

Do we need a Data Protection Officer under the GDPR?

Article 37 requires a DPO when your core activities involve large-scale, regular and systematic monitoring of people, or large-scale processing of special categories such as health data. Many B2B SaaS companies fall below that line. Health tech, health and safety platforms and companies that track user behaviour at scale often fall above it. Truvo offers a fractional privacy officer when the role is required.

What is the difference between a controller and a processor under the GDPR?

A controller decides why and how personal data is processed. A processor handles personal data on a controller's behalf. Most B2B SaaS companies are processors for their customers' data and controllers for their own marketing, sales and employee data. Article 28 requires a written contract between the two, and Truvo maps your role for each processing activity before writing any documents.

How much of GDPR compliance does SOC 2 or ISO 27001 already cover?

SOC 2 and ISO 27001 cover most of Article 32, the security of processing article: access control, encryption, logging, vendor management, backup and incident response. The rest of the GDPR is privacy work those frameworks leave open: records of processing, lawful basis, retention, rights requests, DPIAs and international transfers. Truvo maps your existing controls first, so the GDPR work adds only the privacy layer.

What are the fines for breaking the GDPR?

Article 83 allows fines up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the most serious infringements, and up to 10 million euros or 2 percent for others. For most companies outside the EU, the more immediate cost is commercial: European customers ask for GDPR evidence in procurement, and a missing answer stalls the deal.

Managed Compliance

GDPR compliance consulting for companies with European customers

Talk to a GDPR consultant

Our team's experience includes projects with

What a GDPR engagement covers

Scoping read

Records of processing

Lawful basis and DPIAs

Contracts and EU data transfers

Rights requests and breach response

Article 32 mapped to your existing controls

Assess, Build, Operate, applied to the GDPR

01

Assess

02

Build

03

Operate

What you hold at the end

What changes with a GDPR program

You know where the GDPR reaches you

Security evidence does double duty

Every EU data flow has a transfer mechanism

European deals keep moving

Who GDPR consulting is for

Right call when

Wrong call when

Frequently asked questions

Does the GDPR apply to a company outside the EU?

Do we need a Data Protection Officer under the GDPR?

What is the difference between a controller and a processor under the GDPR?

How much of GDPR compliance does SOC 2 or ISO 27001 already cover?

What are the fines for breaking the GDPR?

Talk to the architect who would do the work

From the blog: privacy and data protection

Quebec Law 25 Compliance: The Privacy Law Every SaaS Company Should Know About (But Probably Doesn't)

Law 25 Compliance Checklist: What Security Teams Actually Need to Do

After Bill C-27: Quebec Law 25 and Canadian Privacy Costs

Frameworks

GRC Platforms

Managed Services

Professional Services

Free Tools

Popular Pages

Company

Subscribe to our newsletter