Personal Data Protection

We scan servers, databases, file storage, CRM, backups; identify where and what personal data is processed.

We prepare the document the controller must maintain and present to CNPDCP upon request.

We tag data on health, biometrics, racial origin, political views, criminal records — special regime applies.

Visualization: where data is transferred (third parties, processors, countries), on what basis.

With mandatory elements per art. 13–14: controller identity, purposes, bases, retention, rights, DPO contacts.

Explicit, separated, revocable consent forms for marketing, newsletters, third-party transfers.

Contracts with hosting, CRM, marketing platforms, accounting services.

Personal data security policy, access regulation, incident management procedure.

Granular consent mechanism with cookie categories.

TDE on databases, storage volume encryption, backup encryption.

TLS 1.3 deployment, HSTS, mTLS between microservices.

Data masking for test environments, PAN tokenization.

RBAC/ABAC, MFA, key rotation, orphan account cleanup.

Centralized log collection (ELK/Loki), WORM storage, event correlation.

Secure form with requester identification on client's site.

Ticket system with 30-day SLA, escalation, templates, export for portability.

Secure deletion scripts respecting legal retention, cascading deletion across systems.

Documented plan: detection → assessment → notify CNPDCP within 72h → notify subjects.

Ready forms (RO/RU/EN) for CNPDCP filings and affected subjects.

Breach simulation with client's team, measurement of real response time.

Checklist per art. 36 — mass profiling, special categories, video surveillance, etc.

Full report with risks, mitigation measures, residual risk.

Preparation of CNPDCP submission package if residual risk remains high.

Certified external DPO: CNPDCP registration, RoPA maintenance, requests, quarterly report.

Function transfer to employee: training program, document templates, annual support.

External annual review of the client's internal DPO operations.

Check: country recognized adequate, or SCC/BCR/explicit consent needed.

EU template localization, integration into processor contracts (AWS, Google Cloud).