• GDPR Gap Analysis: We can conduct an assessment of an organization's current data protection practices and compare them to GDPR requirements. We identify areas of non-compliance, provide a detailed report on the gaps, and offer recommendations to address those gaps.
  
  
• Data Protection Impact Assessments (DPIAs): We help organizations conduct DPIAs for projects involving the processing of personal data that present high risks to individuals' rights and freedoms. We guide the organization through the process, identify potential privacy risks, and suggest mitigation measures.
  
  
• Privacy Policy and Notice Review: We can review an organization's privacy policies, terms of service, and data collection notices to ensure they are in line with GDPR requirements. We provide guidance on necessary updates or revisions to make the policies compliant.
  
  
• Consent Management: We can assist organizations in implementing appropriate consent management mechanisms to ensure they meet the GDPR's consent requirements. This includes reviewing consent mechanisms, providing guidance on obtaining valid consent, and developing processes to manage and document consent.
  
  
• Vendor Management and Data Processing Agreements: We can help organizations review and update their vendor contracts and data processing agreements to ensure compliance with GDPR requirements. We assess the data protection obligations of vendors, negotiate contract terms, and advise on the appropriate safeguards for data transfers.
  
  
• Data Subject Rights Support: We guide organizations in establishing processes and procedures to handle data subject rights requests effectively. We assist in developing response templates, training staff on handling requests, and ensuring compliance with GDPR timelines and requirements.
  
  
• Data Breach Preparedness and Response: We assist organizations in developing and implementing data breach response plans aligned with GDPR requirements. We provide guidance on incident response procedures, breach notification obligations, and coordination with data protection authorities. If you're using a cloud provider, you need to have a well-documented incident response program in place for AWS, Microsoft Azure, GCP, or some other type of environment.
  
  
• Training and Awareness: We offer GDPR training programs and workshops tailored to the organization's specific needs. This includes educating employees on GDPR principles, data protection best practices, and their roles and responsibilities in maintaining compliance. 

Contact MorganHill today to learn more about our GDPR consulting & advisory services for U.S. businesses. 

With MorganHill we offer a wide range of specialty documents for ISO 27001, cybersecurity, data privacy, and much more. Save dozens of hours and thousands of dollars with our industry leading policies, procedures, programs, and plans.