ANSPDCP inspection readiness
What happens when a letter arrives
It usually begins with a written request from ANSPDCP. Sometimes it follows a complaint from an individual, sometimes it is part of a review of a whole sector. Either way, the first thing asked for is the same: documents.
What is commonly requested: the records of processing activities, the notices given to data subjects, the lawful bases for the processing named in the complaint, the contracts with firms that process data on your behalf and the evidence of your security measures. The deadline to reply is short, and the correspondence is in Romanian.
Here is the real problem. It is not the absence of documents that makes the difference, but the fact that they are assembled in haste, under pressure, by people seeing them for the first time. A hurried reply can open subjects that were never asked about.
What you get
Review of the compliance file
We go through the existing documents and note what is missing, what is out of date and what contradicts itself. Many companies have the documents, but they describe a reality from three years ago.
Rehearsal of an inspection
We ask the questions that are usually asked and note where the answers falter. It is the most useful part of the preparation, because it shows what you did not know you did not know.
Preparing the people who will speak
Who speaks, what they say, and what they must not assert without checking. A wrong statement made in haste can cost more than a missing document.
Help drafting the reply
We help you put together the written reply to the authority: what is sent, in what form, and which documents are attached.
Review of the registers
The records of processing activities and the other registers are the first things asked for. We check that they reflect what actually happens.
Remediation plan with deadlines
For what is missing, you receive a list of what has to be done and by when, ordered by urgency.
What this service covers
The service consists of preparing the documentation and the company representatives. It does not include representation before the courts.
Before, not after
Preparation has the greatest effect when no request has arrived yet. You have time to complete what is missing, and the documents carry the date on which they were drawn up in the ordinary course, rather than one suspiciously close to the letter you received.
If your file has never been reviewed, the right starting point is a compliance audit. And if the complaint started with the website, most often with the cookie banner, see also website and cookie compliance.
Has a request arrived, or do you want to be ready?
Tell us which situation you are in and what documents you already have. If there is a deadline to reply, mention it at the start.
Request a quote