GDPR support for technology companies and SaaS

A customer asks for a DPA, an integration changes data flows or a partner tries to transfer responsibility for its own processes. We connect data protection with contracts, tools and the way your product operates.

What the work aims to achieve

The aim is to support sales and partnerships without taking responsibility for other parties’ actions, and to reduce the risk of disruption and incident costs. Scope follows the data, product and customer requirements.

Scope matched to your situation

  1. 01

    Data roles and contracts

    We establish who is responsible for each process. We draft or negotiate DPAs and partner and subprocessor arrangements so responsibility reflects the parties’ actual control.

  2. 02

    Processes, tools and access

    We map data, vendors and transfers. We align retention, authorisations, records and access rules with team workflows, including agreed practical measures involving M365, MFA and encryption.

  3. 03

    Incidents and customer requirements

    We help assess events and prepare actions and communications. For enterprise sales, we support data and security questionnaires and negotiation of contractual requirements.

The experience behind the advice

Our work includes multiparty arrangements that separate responsibility for processes and complaints handled by other organisations. We define the work around actual roles rather than document labels.

Based in Szczecin, we work remotely with teams in Poland and abroad on Polish law and applicable EU rules.

Meet Maciej Lis

Selected work

Explore our experience

Data roles in a multi-party engagement

Comparing documents in a multi-party engagement and distinguishing responsibility for specific data processing activities.

Business outcome: The client agreed cooperation terms without taking on data protection responsibility for complaints about other parties’ services. This reduced exposure to claims and costs arising from processes outside the client’s own role.

Before we start

Do we need a full document package at launch?

We first establish the data, purposes, tools and recipients. Scope follows obligations and risk, rather than a fixed package unrelated to the product.

Do you provide penetration testing or certification?

This service covers legal work, processes and agreed organisational and security practices. Technical testing and certification require separate specialists and arrangements.

What should I send and how is pricing set?

A product and data overview, vendor and tool list, existing documents and customer questions. For an incident, include its timeline and actions taken. Pricing depends on processes, documents, urgency and implementation scope.

What is your next business milestone?

Describe the situation, deadline and decision you need to make. An introductory discussion will help us establish priorities and the scope of further work.

Book a free consultation

Online · up to 30 minutes · free

Request a free consultation

Choose a few answers and we’ll put your enquiry together. You don’t need legal knowledge or a list of documents to get started.

We’ll check whether your enquiry falls within the scope of our Polish-law practice.