Privacy, made understandable.
Your trusted partner for GDPR, NIS2, and EU AI Act compliance, so you can focus on your core business.
TÜV-certified DPOs
External & independent
GDPR
NIS2
EU AI Act
UK GDPR
3
Free checks & assessments
€250
For the initial audit
15
Questions to get a first indication of your GDPR risk and compliance status
9 min
To get clarity on whether your organisation is required to appoint a DPO
4
Frameworks in one place: GDPR, AI Act, NIS2 and UK GDPR
Data protection, compliance & AI governance that works.
We are a specialised team of Data Protection and AI Ethics Officers, European and international lawyers.
We integrate data protection, cybersecurity and AI compliance into your processes pragmatically and efficiently, with a modular pricing and services model that ensures you only pay for what you need.
Our goal is to make data protection, cybersecurity and AI compliance requirements understandable, and to develop measures that fit seamlessly into your existing processes — rather than adding complexity on top of them.
Our services
From formal appointment to day-to-day documentation — each service can be booked individually or as part of a continuous path towards compliance.
How we work with you
A consulting engagement, not a subscription. Start with a free orientation, add a diagnosis, or bring us in as your external DPO.
01
Orientation
Free
Free initial assessment of your data protection situation for a chosen regulation (GDPR, UK GDPR, NIS2 or EU AI Act), including an assessment form and a 30-minute consultation call.
02
Diagnosis
€250 per regulation, one-time
Detailed analysis of your processes under a chosen regulation (GDPR, UK GDPR, NIS2 or EU AI Act), with concrete action recommendations and a written compliance report.
03
Full support
from €400 / month per regulation
We take on the role of your external Data Protection / AI Ethics Officers, supporting you under a chosen regulation (GDPR, UK GDPR, NIS2 or EU AI Act) — including documentation, advisory and annual review.
04
Add-ons
Modular / as needed
Live workshops (including bespoke, tailored sessions), extra documentation support, EU AI Act advisory, or representative appointment under Art. 27 GDPR or UK GDPR — booked flexibly, on top of any tier.
- Additional consulting by the hour, at €150/hour
- Monthly package: 4 hours of 1:1 consulting for €399/month
- Annual package: 48 hours of 1:1 consulting for €4,599/year
- Live workshop for your team, from €399
Each tier can be booked individually or as part of a continuous path towards compliance.
How we help
The same four stages, whichever tier you start from.
01
Understand
Two free assessments of your current compliance situation, a website scan, and a 30-minute conversation to understand where you stand.
02
Structure
A clear compliance framework. Defining what needs to be done, who is responsible, and what matters most.
03
Implement
Turning compliance into practice. Implementing the right processes, documentation, training, and organisational measures.
04
Maintain
Keeping your compliance up to date. Annual re-assessments, monitoring legal and regulatory changes, and addressing new risks and requirements.
Privacy regulation doesn't stand still. Neither does our support.
GDPR, the AI Act and NIS2 increasingly overlap. We work across all three, so you don't have to piece the picture together yourself.
Data protection
GDPR
Processing records, technical and organisational measures, and data subject rights, supported by practical guidance and, where required, DPO services.
AI compliance
EU AI Act
Assessment of your AI systems and tools to identify compliance gaps, with practical guidance on risk classification and the obligations that apply to your specific use of AI.
Cybersecurity & resilience
NIS2
Documentation, risk management, security measures, and annual reassessments aligned with NIS2 requirements for cybersecurity and incident reporting.
UK compliance
UK GDPR
Assessment of UK GDPR requirements alongside EU GDPR, with guidance on the specific obligations that apply when operating across the EU and UK.
How healthy is your privacy setup?
A privacy health check, not a form — 15 short questions, an instant overview, and a clear next step.
Free · Self-Assessment
Are you GDPR compliant?
Answer 15 short questions and receive an instant, free overview of your data protection compliance status.
Start your privacy check
Free · Quick Check
Do you need a DPO?
6 short questions on whether you're legally required to appoint a Data Protection Officer.
Check DPO requirements
Free · Website scan
Is your website compliant?
A scan of your website to check it against GDPR and UK GDPR requirements.
Check your websiteExpertise without the complexity.
Legal depth, technical understanding and regulatory know-how — bundled into an external DPO team that takes responsibility.
TÜV-certified DPOs
Officially certified under Art. 37 GDPR.
Legal & regulatory expertise
Solid knowledge of the GDPR, the EU AI Act and international data protection law.
Technical understanding
Practical knowledge of IT systems, data flows and technical-organisational measures, to correctly assess real risk.
International experience
Coordinating cross-border projects and compliance across multiple jurisdictions.
Fast data breach response
A structured approach to reporting, containment and damage mitigation when it matters.
Stakeholder management
Clear coordination with authorities, management and business units, nationally and internationally.
Employee training
Hands-on training and awareness sessions for your staff, so data protection becomes part of daily practice.
Direct communication with management
Clear, direct coordination with your leadership team.
Legal project management
Structured management of data protection and compliance projects – from planning to execution, on time and on budget.
Frequently asked questions
The questions we hear most before a first conversation.
Do we need a Data Protection Officer?
It depends on factors set out in Art. 37 GDPR — for example, whether your core activities involve large-scale, systematic monitoring of individuals, or large-scale processing of special category data. Our free 6-question DPO Check gives you an initial indication in about 2 minutes.
What does an external DPO do?
As your externally appointed DPO under Art. 37 GDPR, we advise your organisation and staff on data protection obligations, monitor compliance, and act as the point of contact for the supervisory authority — while remaining independent of your management structure.
What does support cost?
The initial orientation — an assessment form and a 30-minute conversation — is free. A detailed diagnosis with a written compliance report is €250 one-time per regulation. Ongoing support as your external DPO starts at €400 per month per regulation.
What happens during the initial assessment?
You complete a short assessment form and join a 30-minute consultation call. It's free and non-binding, and gives us a first picture of your data protection situation.
Can DataProFirst help with the AI Act?
Yes. We offer a website compliance scan and advisory on the EU AI Act, and cover AI Act topics as part of our personal advisory sessions.
Do you help with GDPR documentation?
Yes. We create, maintain and update your processing records, technical and organisational measures (TOMs), DPIAs and data processing agreements — including the documentation required under NIS2.
Can you support us on an ongoing basis?
Yes. As your external DPO we provide ongoing support across all data protection matters, including documentation, advisory and an annual re-assessment to keep you up to date.
Insights on data protection & cybersecurity
Practical articles on GDPR, data protection and cybersecurity from the DataProFirst team.
The High-Risk Draft Guidelines Are Here: What to Do Next
The European Commission's draft guidelines on classifying high-risk AI systems are open for consultation until 23 June 2026 — here's what organisations need to know.
Read moreWhat is a Data Protection Officer and does your organisation need one?
The DPO role in a nutshell: who qualifies, what they do, and when you are legally required to appoint one.
Read moreGDPR: “Legitimate Interest” for business leaders and what makes it different from Consent
Many business leaders think legitimate interest is a shortcut around consent. Getting that wrong can be costly.
Read moreLet's make privacy practical.
Request your free, no-obligation initial assessment. The first step towards GDPR compliance is free.