GDPR consulting · DPIA · Privacy by design
GDPR consulting that works in practice, not just on paper.
We build privacy into how products, data and AI are designed and delivered, so GDPR and CCPA stop slowing launches down and start earning customer trust.
What does GDPR consulting cover?
GDPR consulting turns the regulation into processes your teams can follow: a record of what personal data you hold and why, DPIAs for risky processing, privacy by design in new products and AI, retention and consent that work, and clear answers when regulators or customers ask questions.
The privacy rules that already apply
GDPR applies across the EU
In forceEU AI Act: banned AI practices and AI literacy
In forceEU AI Act high-risk obligations apply (Annex III)
Next
What we do
GDPR and CCPA operationalisation
Turn legal requirements into processes, controls and responsibilities your teams can follow.
DPIAs and privacy by design
Privacy built into product and AI design, with DPIAs that keep pace with your releases.
Data mapping and retention
A living record of processing: what personal data you hold, where it flows and how long you keep it.
GDPR and CCPA in operation
Consent, data subject requests and vendor checks that run as everyday processes, not one-off projects.
How it works
- 01
Map
Find personal data across systems, vendors and AI use cases.
- 02
Assess
Run DPIAs where the risk is high, and fix the findings.
- 03
Build in
Privacy checks in product and AI delivery, not after it.
- 04
Maintain
Keep records, consent and retention current as you change.
What you get
- Privacy requirements built into delivery
- An up-to-date record of processing
- DPIAs that keep up with releases
- Confidence when regulators or customers ask
The standards we work to
- GDPR
- CCPA
Start with a fixed-scope sprint
Find and fix the privacy gaps in your most important systems.
Privacy-by-Design Review
Data map of key systems · DPIAs where required · Consent and retention fixes
Get a proposal →Why teams choose Consudo for Data Privacy
Senior people, start to finish
The specialists who scope the work do the work. No junior hand-offs, no slideware.
One plan across four disciplines
Data, AI, privacy and security share the same foundations, so we design them once instead of four times.
Built for your teams to own
Policies, controls and evidence your people run without us, with knowledge transfer built into every engagement.
Data Privacy: frequently asked questions
When is a DPIA required under GDPR?
Article 35 of GDPR requires a Data Protection Impact Assessment before processing that is likely to result in a high risk to people, for example large-scale profiling, large-scale use of sensitive data or systematic monitoring of public areas. Many AI use cases meet that bar.
Can we use personal data to train or run AI?
Often yes, but you need a lawful basis, a clear purpose, data minimisation and transparency towards the people concerned, and usually a DPIA. We run privacy and AI risk assessments as one process so you do the work once.
Do we need a data protection officer?
Under Article 37 of GDPR you must appoint a DPO if you are a public body, or if your core activities involve large-scale, regular monitoring of people or large-scale processing of sensitive data. Many other companies choose one anyway, in house or outsourced.
How do privacy and AI governance fit together?
Most AI systems process personal data, so privacy assessments and AI risk assessments overlap. We run them as one process, with one set of evidence, so your teams answer the same questions once instead of twice.
Designed to work together
Questions first? Email info@consudo.com and get a right-sized, senior-led proposal within 48 hours.