GDPR
GDPR Compliance for Businesses
The GDPR (the EU's General Data Protection Regulation) sets the rules for processing personal data. Together with Montenegro's Law on Personal Data Protection, it applies to practically every organisation that processes the data of employees, clients or users — especially those doing business with the EU market.
What is the GDPR?
The GDPR isn't an IT project but a legal-and-organisational system: an organisation must know which personal data it processes, on what legal basis, how long it retains it, who it shares it with, and how it protects it. Compliance is demonstrated through documentation and practice — the principle of accountability.
We help you carry out compliance pragmatically: without unnecessary bureaucracy, with documents employees actually understand and procedures that hold up even when the regulator comes knocking.
Implementation phases
The real phases we guide every project through — from preparation to the certificate, which comes only at the end:
Risk Assessment and Protective Measures
We carry out compliance through proven steps: Not sure whether you already meet these requirements? Check with the short self-assessment at the bottom of this page.
Mapping processing activities (data mapping)
We catalogue every processing of personal data: purposes, categories of data and data subjects, recipients, retention periods and transfers.
Legal bases and records
For each processing activity we establish the legal basis and draw up records of processing activities.
Policies and notices
A privacy policy, notices to data subjects, a cookie policy, internal data-protection rules.
Processor agreements
Data processing agreements (DPAs) with IT providers, accountants, agencies and other processors.
Data-subject rights and data breaches
Procedures for data-subject requests (access, rectification, erasure) and for handling a data breach within 72 hours.
Risk assessment and protective measures
DPIAs for high-risk processing and organisational-technical measures: access control, encryption, staff training.
The path to certification
The GDPR has no certificate in the classic sense, but compliance is confirmed through:
The prerequisite for everything: the system is implemented and applied in practice — every requirement of the standard met, the internal audit carried out and the management review completed.
A periodic review of documentation and practice with a status report.
The strongest independent proof of GDPR accountability — a certified privacy information management system.
When needed, we provide a data protection officer (DPO) function as a service.
Updating documentation whenever new processing activities, tools or regulatory changes arise.
Benefits of Adopting the Standard
GDPR fines reach €20 million or 4% of global turnover, and national data-protection laws add their own — Montenegro's new 2026 law, for example, provides for fines of up to €2 million or 4% of worldwide turnover.
European clients require proof of compliance from suppliers that process data.
Transparent data processing becomes a competitive advantage.
Data mapping also reveals unnecessary processing — less data means less risk and lower cost.
An illustrative, typical scenario we often hear from clients — it does not represent a specific, named client.
“We had been collecting clients’ personal data for years, with no clear legal basis and no retention period — everything ‘just in case’. Getting ready for the GDPR forced us to build a record of processing activities and to define a legal basis and an erasure deadline for each one — now, when someone asks us to delete their data, we know exactly where all of it is.”
— a common scenario among our clients
Related standards
ISO 27701 turns GDPR compliance into a certified privacy management system, while ISO 27001 provides the technical-organisational data security the GDPR requires. Together they form a complete data-protection framework.
GDPR training — from a basic understanding of the standard to internal auditor training. Delivered at your premises, online or as a combination of both.
FAQ about the GDPR
Does the GDPR apply to companies outside the EU?
Yes — directly if you offer goods or services to individuals in the EU or monitor their behaviour. National laws add their own rules: Montenegro's Law on Personal Data Protection, adopted in September 2026, is aligned with the GDPR and sets out essentially the same obligations for domestic organisations.
Do we need a DPO?
It's mandatory for public authorities and organisations whose core activity is systematic monitoring of individuals or large-scale processing of special categories of data. We help you assess the obligation and provide the function.
How long does compliance take?
For small and medium organisations, usually 1 to 3 months, depending on the number of processing activities and systems. For large systems — over 500 employees, multiple locations or an integrated system of several standards — a project realistically runs beyond a year; we handle those clients too.
Is there a GDPR certificate?
Official GDPR certification schemes are rare; in practice, an ISO 27701 certificate is used as independent proof.
How much does GDPR compliance implementation cost?
There is no fixed price that applies to everyone — the cost depends on the organisation's field of activity, its size and number of employees, the chosen standard and the current state of the system. Send us a short description of your organisation and we will prepare a free, tailored estimate.
Standards that fit together like a honeycomb
Each standard keeps its own shape, but together they form a single solid, integrated management system (IMS) — with no gaps or overlaps. Click a hexagon to open that standard.
More about the integrated management system
An integrated management system (IMS) combines two or more ISO standards — for example GDPR with ISO 9001 or ISO 14001 — into one shared framework of documentation, objectives and internal reviews, instead of each standard living in its own parallel procedure.
A single structure (the High-Level Structure — HLS) shared by every modern ISO standard. Thanks to it, the quality policy, risk management, internal audits and management review can be common to several standards at once.
Each standard on its own addresses one part of the business — quality, environment, safety, information. When an organisation introduces several of them, separate systems quickly duplicate the same documentation and the same auditors.
Less duplicated procedure work, simpler management, stronger process oversight, more efficient use of resources and easier preparation for a combined certification audit.
GDPR can be implemented on its own or as part of an integrated system — the decision depends on how many standards you're targeting and whether you're introducing them at once or gradually.
Check your organization's readiness
Answer a few questions and receive an indicative assessment of your organization's current level of readiness for GDPR / Personal Data Protection.
This self-assessment provides an indicative readiness result only. It does not constitute certification, an official audit, or formal confirmation of compliance.
The EU, the US and other markets
GDPR / Personal Data Protection is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Montenegro and the region
When people ask about a GDPR certificate, they mean proof of compliance. Official GDPR certification schemes are rare, so in practice an ISO/IEC 27701 certificate (alongside ISO/IEC 27001) is used — issued by an independent accredited certification body.
Our core activity is standards implementation and rollout: we prepare your organisation so the certification audit goes without surprises, and we explain terms like "GDPR certification" and "GDPR certificate" because that's exactly how clients search for them. What certification, accreditation, IAF and surveillance audits involve — read the Certification / ISO Certificate page, and about tender designations on the ISO Standards in Tenders page.
Montenegro is where we work from: our consultants are based in Podgorica, Budva and Bijelo Polje, documentation and training come in Montenegrin or in English, and the certificate itself is issued by an independent accredited certification body — not by us. We work on site in Serbia, Bosnia and Herzegovina, Croatia, North Macedonia, Albania and Kosovo as well — more about what we do in Montenegro.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a free consultation
We will assess the scope of work and propose a realistic plan and budget for your organisation. Call us or send an inquiry — we reply within 24 hours.