Data Protection

Together with a team of professional, specialized in different areas of practice, such as legal, technological and IT, we assist our Clients in redacting a complete and efficient GDPR compliance plan. Our services are usually customized on the basis of the needs of the single Client, of the organizational structure and of the complexity of such structure; furthermore, our compliance plan can easily be adapted to the company in its complex, or to a single project or process.

Our added value is considering consultancy as a set of legal and informatics specialized services, in the field of data protection, guaranteeing solutions which are both compliant with the applicable laws and easily feasible.

Our Services include:

• Mapping of all data processed and of the categories of data subjects involved;
• Analysis of all processes and personal data flows;
• Identification of subjects (both internal and external) which are involved in the data processing activities;
• Analysis of the data processing policies already adopted by the Client;
• Analysis of all existing technical and organizational security measures;
• Identification of synergies with Organization Models (corporate, banking, insurance compliance laws and for the prevention of informatic crimes, in compliance with art. D.Lgs. 231/2001 etc.);
• Evaluation of preexisting provision of the Supervisory Authorities, addressed to the Client or, more in general, in relation to similar areas of practice or projects.

All this information is usually collected by our professional, who will carry out specific interviews with single departments, as well as a thorough documental due diligence.

Our service also includes the definition and drafting of all necessary law requirements, specifically customized to the Client’s area of business (e.g. specific privacy notice for different specific sectors, modular consent forms, data processing agreements, prior Consultation to the Authority etc.).

The release of the documents is – case by case – usually accompanied by a summary report, which includes the assessment’s result and specific instructions on how to use the documents delivered.

Our goal is to support our Clients in defining corporate principles on the protection of personal data, in order to ensure that all processing activities are compliant with the GDPR and with the national relevant laws, but also in line with the business’ goals.

With this service, we offer to our clients constant support, helping them on an ongoing basis in dealing with problems relating to the processing of personal data. Our goal is to offer to our clients the well-established experience of our professionals in order to find quick and effective solutions to the increasingly frequent privacy implications of the daily management of business activities.

Our services may include, by way of example, the following activities:

• Assistance in managing requests from the data subjects; 
• Updating or drafting privacy notices and consent forms;
• Updating or drafting procedures, policies and/or operating instructions;
• Assistance in defining privacy roles and responsibilities with external providers and drafting all necessary documents required by the law;
• Assistance in evaluating informatic instruments and/or new technologies for processing of personal data;
• Assistance in launching digital marketing campaigns, or sponsoring projects, in full compliance with data protection requirements;
• Assistance in launching recruitment projects, or selection of personnel, in full compliance with data protection requirements;
• Legal advice in launching new projects which may involve processing of personal data;
• Periodical audits to verify the client’s compliance, either in general or with regard to single business areas;
• Assistance at the client’s offices during inspections carried out by the supervisory authority or by the Custom Police.

With regard to the modalities of our intervention, we offer the typical “help desk” methodology: which means flexibility and freedom for the Client to define an annual budget which shall be allocated to the services, so as to take full advantage of the economies of scale.

Data protection laws applies differently in relation to various sectors (e.g. scientific research, health sector, pharmaceutical sector, telemedicine, retail, third sector, artificial intelligence, video surveillance etc.) and has relevant impacts in consideration of the intended use for the data (e.g. marketing, communication, employment management, digital services etc.)

Our approach in providing opinions goes beyond the traditional methodology and it is characterized by a strong practical approach. Our opinions are always correlated by a summary and various attachments with all documents necessary to ensure the Client’s compliance. Furthermore, it is our priority to educate the Client’s personnel on the contents of the opinion and, where, necessary, interacting with the third service providers, which shall carry out all the necessary intervention pursuant to the opinion.

Among our services, we offer training and learning sessions on specific subjects, including privacy and protection of personal data, corporate compliance and Organizational Model pursuant to D. Lgs. 231/2001.

Our learning sessions include both general and theoretical notions on the main principles of the applicable laws, and more technical and practical notions, tailored on the area of business of the Client, as well as on any relevant sectorial applicable law. Furthermore, and within our consultancy services, we offer specific training sessions on the correct use and implementation of all documents and deliverables prepared for the Client (e.g. appointments of delegates, policies, information notices etc.).

All our learning services are modulated and adapted to the specific needs of the Client, and can be delivered both in class and at distance; timing, duration and recipients of such sessions are always defined in advance and agreed upon with the Client, with the possibility to arrange single sessions for personnel with specific duties and competences within the company.

We furthermore offer drafting of learning materials (e.g. awareness raising materials, simulations of possible scenarios with fictional characters, legal text easily accessible via hypertext) which can also be uploaded into e-learning platforms including animations, sounds, multiple answers questions and randomized answers.

We also offer a range of “ready-to-go” solutions, thanks to a consolidated collaboration with our technological partner Mediamed Interactive, which allows us to offer to our Clients a product based on the more evolved and widespread  training platforms, so that our Clients can enjoy both standard sessions or more tailored sessions.

We assist and represent our Clients in administrative proceeding before the Italian Data Protection Authority and before other Europeans’ Supervisory Authorities, in cases of, by way of example:

• Requests to provide documents and information by the Authority after a complaint brought by a data subjects;
• Investigations carried out by the Authority after an administrative complaint;
• Pleadings against administrative sanctions;
• Notification of violations of personal data to the Authority, pursuant to art. 33 GDPR;
• Request for prior consultation to the Authority, pursuant to art. 36 GDPR.

Pursuant to art. 35 of the GDPR, we offer our Client support in all risk analysis evaluations required by GDPR for those processing activities which, due to their purpose, nature and context, and in relation to the business area where the Client operates, may potentially pose a risk for the rights and freedoms of the data subjects involved. 

In this context, we offer our Data Protection Impact Assessment services (i.e. DPIA), which include:

• Preliminary opinion on the necessity to carry out a DPIA, after a technical and legal analysis of the processing operations, in light of the legislative requirements (both national and European) and considering the nature of the Client’s activities and any applicable sectorial legislation;
• After establishing the necessity or the opportunity to carry out a DPIA, analysis of the corporate processes and of all the personal data flows in the relevant area, from a technical and legal standpoint;
• Assessment of the necessity and the proportionality of the processing, in relation to the purposes to achieve, together with an evaluation of the risks for the rights and freedoms of the individuals;
• Identification of all the required document to be drafted, pursuant to the applicable data protection laws and to the specific sectorial law (e.g. privacy notice, procedures, consent forms, specific modalities for collection of consents etc.);
• Definition of operating procedure for designing data flaws in a privacy compliant manner;
• Definition of organizational processes, adequate security procedures and appropriate mechanisms to ensure protection of personal data and full compliance with the GDPR and with the specific sectorial laws;
• Where necessary, support in involving and/or collecting the opinions of the data subjects (or their representatives);
• Where necessary, assistance in prior consultation to the Supervisory Authority, pursuant to art. 36 of the GDPR, and where the residual risk, after analysis and adoption of security measures, remains high.

Thanks to a wide experience in the field, together with constant updates and attentions to news and novelties in the legal and technological framework, we offer our Clients a complete and precise service, with a dynamic and innovative approach which goes beyond the mere analysis of the privacy risks connected to a single operation (usually offered by most tools available on the market). Our analysis in fact, also considers and analyzes the potential implications on the individual rights of the data subjects, including, by way of example, the right to self-determination, the right to image, to reputation, the right to health and to integrity. 

Out DPIA services are offered by a cross disciplinary team of experts in different areas, including legal and information security, through which we can assist our Clients in adopting adequate security measures, ensuring full compliance with data protection laws.

We assist our Clients in defining and regulating the contractual relationship with strategic providers, entrusted with processing activities of personal data, especially in those business areas which are subjected to specific sectorial laws on externalizations (e.g. pharmaceutical sector). 

With regard to this area, our services include:

• Preliminary evaluation of the general overall level of compliance of the provider, where there are specific legislative requirements which the provider has guaranteed upon;
• Assistance in drafting and reviewing service agreements, in all aspects which may have implication on the protection of personal data;
• Assistance in defining privacy roles and responsibilities with the service providers by drafting, where necessary, ad hoc appointments as Data Processor, pursuant to art. 28 GDPR, customized on the Client’s needs and on the characteristics of the specific service offered by the provider;
• Legal and technical verification of the adoption, by the provider, of adequate technical and organizational measures to ensure security and integrity of personal data processed on behalf of the Client.

Our services are specifically customized to the Client’s necessities, end include both a preliminary verification during the selection of an outsourcer and a subsequent control of the compliance level of the chosen provider for a specific service or activity.

Analysis and drafting of documents are carried out by cross disciplinary teams, including legal, technological, IT experts and professionals.

Our Data Protection Officer services, are carefully customized to the size, the peculiarity and the characteristics of the Client’s organization, and include the  thorough verification of the general compliance levels of the Client with the requirements of the law; proactive actions in promoting the fulfilment of legislative obligations, and an internal guarantee for the respect of such obligations.

Our Data Protection Officer services include:

• Support in drafting and updating corporate Policies and support in their enactment;
• Consultancy and advice on single relevant privacy issue;
• Support on how to properly set privacy initiatives, activities, and applications;
• Control over processing activities carried out by the Client or by external providers acting on Client’s behalf;
• Management of personal data breaches; 
• Management of requests from the competent authorities;
• Management of data subject’s requests;
• Maintenance of privacy compliance systems; 
• Reports to management;
• Constant update and training;
• On-site assistance in the occasions of investigation by the Italian Authority.

Our Data Protection Officer’s services are offered by a team of legal and data security experts, who will constantly interact and support the Client’s internal departments in the daily compliance with all the requirements of the law. Our goal is to transform the mere compliance with a legal obligation into an added value for our Clients.

In case there are still news of criminal records or other defamatory information on the internet, affecting the reputation of our clients, our team of experts will assist them in enforcing the Right to be Forgotten.

In such cases, it will be necessary to bring to the attention of our team of legal experts on the right to be forgotten and IT experts, the relevant link harming the client’s reputation; our team will then device an effective plan, in order to assess whether the criteria to apply the right to be forgotten, and therefore to remove the malicious link, pursuant to art. 17 GDPR, are met.

Nowadays, Google is the most used and advanced search engine, and the information show on the first page, connected to your name, are what matters the most.

It often happens to be subjected to external attacks, due to negative past experiences or criminal records, which remain on the internet for a very long time and are very easy to retrieve even after years.

One should know that a legal action against Google (or other search engines) could very easily be counterproductive, and this is not how we work: a legal action in fact would imply a considerable amount of legal expenses, and would be very time consuming.

Our working method is tried and true and aims at solving the problem in the shortest possible time, in order to help our client to effectively enforce their right to be forgotten.

Nowadays, within the context of their daily business activities, all companies must face different legal issue, whose resolution often requires a cross disciplinary approach; finding an effective solution to such issue, may easily result in an increase of management costs, as well as in a waste of energies and efforts, which inevitably impacts the timing of the intervention.

In order to meet these needs, we offer our Legal Desk services, which are specifically addressed to Small or Medium Size Companies.

We specifically offer legal assistance and cross disciplinary consulting services on whose availability and swiftness our Clients can always rely on.

Our services are designed for small companies or entities that intend to outsource the resolution of legal issues, but it may also represent a valuable support to the legal departments of bigger and more structured companies.

We offer our specialist services through a team of senior professional – specialized in different areas – which may help the Client in capitalizing legal consultancies, by guaranteeing a constant legal update in its area of business; our cross-disciplinary approach moreover, allows to fully exploit the economies of scale.

Among our areas of practice:

• Assistance in corporate compliance (e.g. protection of personal data, workplace safety, environmental laws, D. Lgs 231/2001, healthcare regulation);
• Contractual assistance (both active and passive cycle);
• Drafting/verification of legal/commercial correspondence;
• Legal assistance for the protection of intellectual properties;
• Legal/technical-organizational assistance on the use of telematic and informatic systems;
• Legal assistance in the area of marketing and communication;
• Credits management and collection, both in Italy and abroad.

To each of our Clients, within the context of our services, we offer the support of a dedicated “legal contact person”, who shall coordinate the action and shall have direct and regular contacts with the company. We believe that such presence:

• Consolidates trust with the Client;
• Allows better customization of the services, on the basis of a deeper knowledge of the Client’s needs;
• Guarantees a constant legal presence, which may actively interact with the Client.

With regard to the modalities of our intervention, we offer the typical “help desk” methodology: which means flexibility and freedom for the Client to define an annual budget which shall be allocated to the services, so as to take full advantage of the economies of scale.

Our goal is to transform what up until today has – probably – been perceived as the sole cost of compliance, into an insurance – or better, an investment in a well-done job.