Implementation services for GDPR, UK GDPR, ISO 27001, SOC 2 and ENS
Compliance built for you. Still working a year later.
We implement the programme for teams of 10 to 300 people: policies, registers, evidence and audit preparation, inside the GRCTrail platform, so it keeps running after we hand over. One 30-minute call, written fixed price within 3 business days.
Evidence items collected, per week
- Project: written and linked by us
- After hand-over: collected automatically from GitHub, AWS, Google Workspace
- 93 Annex A controls, each with evidence linked
- Statement of Applicability signed off in week 9
- 93 / 93
- Programme owner trained, sign-off recorded
- Week 10. No one from GRCTrail has logged in since.
- Done
Which situation is yours?
Most teams come to us because someone asked.
A customer, an investor, a tender or a new country. Pick the one that sounds like yours.
Before we can sign, procurement needs the attached security questionnaire completed. 142 questions.
Procurement, enterprise customer
A customer's security questionnaire is blocking a deal
We answer the one on your desk during the assessment, then build the library and the DPA template so the next ten are routine.
Vendor questionnaires and DPA review2 to 4 weeksWe're happy to move forward, subject to ISO 27001 or a SOC 2 report by the end of Q1.
VP Engineering, prospect
An enterprise prospect wants ISO 27001 or SOC 2, by a date
Gap analysis to an audit-ready ISMS or control set, with the auditor booked around your date.
ISO 27001 and SOC 2 readiness8 to 10 weeks, then the auditFirst UK hire starts in January. Do we need a representative, and what has to exist before her data moves?
Head of People, US company
You're hiring or selling in the EU or UK for the first time
Which laws reach you, in which role, and the records, notices and contracts in place before the first record moves.
GDPR, UK GDPR, multi-country privacy4 to 8 weeksEl pliego exige certificación ENS categoría MEDIA como requisito de solvencia.
Licitación, administración pública
A Spanish public-sector tender names ENS
Categorisation, declaración de aplicabilidad and the controls your pliego requires, delivered in Spanish.
ENS compliance8 to 10 weeks
Not on the list? Describe the situation on the call. Most of what we do started as one of these.
What you walk away with
Documents written for your systems, not templates with your logo.
Every deliverable is editable and yours, inside the platform or exported as DOCX, CSV and PDF. Here is the full set for a GDPR implementation; each service lists its own set the same way.
Each item is produced for your data flows and comes with the evidence that it is in use, so the programme stands up to a supervisory authority or a customer's audit, not only to a reader.
GDPR implementation
10 deliverables, 6 to 8 weeksData inventory and data flow map
Register of systems, flows and recipients
- CSV
Records of processing activities (Art. 30)
Purposes and lawful basis reasoning per activity
- CSV
Privacy notices
Customers, website visitors, candidates, staff
- DOCX
- HTML
Data protection impact assessments
For the processing that needs one
Processor agreement template and vendor register
With DPA status per vendor
- DOCX
- CSV
International transfer assessment and transfer tools
Assessment and clauses
- DOCX
Data subject request and breach response procedures
With request tracking and deadlines
- Procedure
Retention schedule and data protection policy
Versioned
- DOCX
Evidence that each document is in use
Linked to the record it supports
- Platform
Recorded hand-over and readiness sign-off
With whoever owns the programme afterwards
- Video
Why a consultancy with its own platform
One party accountable for the setup and for the system that keeps it alive.
The platform collects evidence and keeps records current. It does not design your controls or write your policies. That is the part we do.
Traditional consultancy
- Who writes the policies and maps the controls
- They do
- What happens after the project
- A folder of documents, current on the day of hand-over
- When the auditor asks for proof
- You search email and shared drives
- Who you call when scope changes
- A new quote
- What you own
- The documents
Tool only
- Who writes the policies and maps the controls
- You do, from templates
- What happens after the project
- Dashboards nobody has owned since onboarding
- When the auditor asks for proof
- You take screenshots
- Who you call when scope changes
- Support
- What you own
- A subscription
GRCTrail services
- Who writes the policies and maps the controls
- We do, for your systems
- What happens after the project
- A live programme with a trained owner, evidence still collecting
- When the auditor asks for proof
- The record is already there, with its source
- Who you call when scope changes
- The same person who built it
- What you own
- Both, and the export
How it works
Four steps. Your time: 20 to 30 hours in total.
1. 30 minutes, free
Scoping call
- You bring
- The frameworks, the countries, what exists today
- We deliver
- Written scope and fixed price within 3 business days
Your time: 30 min
2. 1 to 2 weeks, fixed price
Assessment
- You bring
- One person who knows where the data and systems are
- We deliver
- Gap report and implementation plan, implementation price confirmed
Your time: about 4 h
3. 4 to 10 weeks, fixed price
Implementation
- You bring
- Answers to questions and two sittings to review drafts
- We deliver
- Every document, written for your systems, with evidence it is in use
Your time: 2 to 3 h a week
4. Final week
Hand-over
- You bring
- Whoever owns the programme afterwards
- We deliver
- Recorded session, readiness sign-off, export or platform load at no charge
Your time: about 2 h
After hand-over the trail continues without us: evidence keeps collecting, records stay current, and your owner runs the programme. We are available for surveillance audits if you want us.
How we price
Fixed price, in writing, before any work starts.
We don't publish service prices because the number depends on three things. You get an indicative range on the scoping call and a written fixed price within 3 business days. The assessment price is fixed in the quote; the implementation price is fixed once the assessment confirms the scope, with every finding that could change it listed in advance. Nothing is billed that you have not seen in writing.
Frameworks and countries in scope.
Each adds requirements; outside the EU and UK, local counsel is named in the quote.
Your role in the data and the categories you process.
Controllers need more than processors; health, financial or children's data add assessments.
What already exists.
A working security programme shortens ISO 27001 and SOC 2 work considerably.
Never in our price, named in the quote so you can budget
- The certification audit or SOC 2 examination
- Formal legal opinions
- Acting as your DPO or EU/UK representative
- Penetration testing
We practise what we preach
What you can check before the call.
Our own programme runs on GRCTrail
Our GDPR and ISO 27001 records live in the same platform we hand to you.
Vetted as a vendor
We have completed a full vendor due-diligence review by a Spanish data-protection firm.
EU company, EU hosting
GRCTrail, Valencia, Spain. Platform hosted in the EU. [email protected]
What we don't do
Certification audits, penetration testing, formal legal opinions, acting as your DPO or representative. If you need one, the quote names a partner and their fee is theirs.
If the audit raises a nonconformity against work we delivered, we fix it at no extra charge.
Stated in every quote.
Reachable
Weekly working sessions during the project; replies within one business day. Working languages: English, Ukrainian, Russian; Spanish for documents.
Last reviewed: October 2026
Questions before the call
Nine things people ask us first.
Why aren't service prices on this page?
Because the number depends on the frameworks and countries in scope, your role in the data, and what already exists. Publishing one figure would be wrong for most teams. You get an indicative range on the 30-minute call and a written fixed price within 3 business days. Platform prices are published on the pricing page.
How much of our team's time will this take?
20 to 30 hours in total: about 4 hours during the assessment, 2 to 3 hours a week during implementation for questions and draft reviews, and about 2 hours for the hand-over session. We write the documents; you confirm they describe your company.
How long does it take, really?
The assessment takes 1 to 2 weeks. Implementation takes 4 to 10 weeks depending on the service; each service page states its range. The main variable is how fast your team answers questions and reviews drafts. The certification audit, where there is one, is booked with the auditor around your date.
Do we have to use the GRCTrail platform?
No. Everything is built in GRCTrail during the project because that is where evidence gets linked to records. At hand-over you can keep running the programme there at published platform prices, or take the full export in DOCX, CSV and PDF. The deliverables are the same either way.
We already use Vanta or Drata. Can you still help?
Yes. Those tools collect evidence; they do not design your controls or write your policies for your systems. We do the design and writing, then load the results into the tool you use or into GRCTrail, whichever you prefer.
Do you perform the audit, or act as our DPO?
Neither. The ISO 27001 certificate comes from an accredited certification body, the SOC 2 report from a licensed CPA firm, the ENS certificate from an accredited entity, and you contract them directly. We prepare you, join the auditor calls and fix findings. We do not act as your DPO or EU/UK representative; the quote names a partner if you need one.
Who will we actually work with?
The person on the scoping call runs your project and leads the hand-over. Legal work is reviewed by a practising privacy lawyer engaged on your project; outside the EU and UK, local counsel gives formal opinions and is named in the quote.
What happens after hand-over?
Your trained owner runs the programme. Evidence keeps collecting from connected systems, records stay current, and review dates are tracked in the platform if you keep it. We are available for surveillance audits and scope changes at a separately quoted price; neither is a condition of the engagement.
What if the auditor finds a nonconformity?
If it is against work we delivered, we fix it at no extra charge. That is stated in every quote. If it is against something outside the agreed scope, we tell you what it would take and you decide.
Tell us the framework, the countries and what exists today.
You leave the call with a scope and an indicative range. The written fixed price follows within 3 business days.
After hand-over, your programme can keep living in GRCTrail at published platform prices, or in your export. The deliverables are the same either way.