A GDPR lawyer from Morling helps businesses structure data protection work and strengthen compliance
Few companies operate without processing personal data. The General Data Protection Regulation sets out the conditions under which companies may process personal data, for example to perform a contract. It is therefore essential that companies apply and comply with GDPR requirements whenever personal data is processed.
When companies process personal data, they also have a legal duty to understand and reduce the risks associated with that processing and to take measures to safeguard the data. Depending on the business, a range of measures—some more complex than others—may be needed. As complexity varies with your specific circumstances, a thorough understanding of the framework is vital, both to meet GDPR requirements and to avoid making compliance more complicated than necessary for your operations. This is core gdpr guidance for small businesses and highly relevant to gdpr for businesses across sectors.
We gather enough material to understand which processing activities are most business-critical in the company and where responsibility sits within the organisation. This allows the work to be scoped to the right systems, processes, and parties from the outset.
We translate your processing activities into a clear set of requirements and assess where the risk is greatest based on the type of personal data, purposes, and exposure. The result is decision support showing what needs to be prioritised and why.
You receive a workable plan with sequence, timeline, and ownership that links measures to risk and business value. The plan makes it easier to decide what to handle internally and what should be addressed with external support.
We prepare or update the required documentation and support the rollout of routines in day-to-day operations so the work is consistent. The focus is on being able to demonstrate how requirements are handled when questions arise from customers, suppliers, or during supervision.
You get a setup for ongoing controls where changes in the business are captured and translated into updated routines and decisions. This ensures compliance doesn’t become a one-off project, but part of governance over time.
For companies, GDPR is about being able to demonstrate control, not just “having a policy”. Set the framework with records, contracts and clear routines for how data is handled and retained. Click through to build a structure that withstands change and growth.
GDPR infringements can result in significant fines for companies. Administrative fines may be up to the higher of EUR 20 million or 4% of global annual turnover. The amount in an individual case depends on the specific circumstances. The Swedish Data Protection Authority (IMY) may also issue a warning, reprimand or an order, including restrictions or prohibitions. Depending on what has occurred, a fine is not inevitable.
The high maximum amounts underline the importance of taking GDPR seriously and implementing robust data protection practices. Beyond financial impact, infringements can damage reputation and erode the confidence of customers and other stakeholders. To reduce the risk of fines, companies should:
REGARDLESS OF SIZE
Does GDPR apply to companies? Yes — GDPR applies to all companies that process personal data. It therefore affects most businesses and imposes requirements across every phase of personal data processing. A challenge is that companies of all sizes face the same baseline obligations. GDPR for small businesses is therefore as relevant as for larger organisations, irrespective of the resources available to support compliance.
What does GDPR mean for companies? To comply with GDPR, companies must adhere to the principles for processing personal data and a range of detailed requirements, including implementing appropriate technical and organisational security measures. This entails, for example, having clear procedures for personal data processing, ensuring data is accurate and up to date, and having systems to erase or rectify inaccurate data. GDPR is extensive, and these examples are only a selection.
One fundamental principle is transparency. Companies must clearly inform individuals about how their personal data is collected and used. This means there must be a clear and easily accessible privacy notice describing the personal data processing for which the company is responsible.
GDPR also grants individuals specific rights, such as the right to data portability and the right to be forgotten. Companies need procedures to handle such requests from data subjects. If these requests are frequent, there should be established routines to manage them promptly, typically within 30 days. This is central to practical gdpr guidance for small businesses and applies equally as gdpr for businesses across industries, including gdpr compliance for saas companies where data flows are continuous.
Telephone call recording is sensitive from a privacy perspective. A call contains not only the conversation, but also other personal data protected by GDPR such as voice and emotional tone. Calls may also include data the company did not expect to capture, for example health information or other special categories of personal data protected under Article 9 GDPR. More than one person is involved in a call—such as a customer and an employee—and they may have different interests in whether recording is permissible.
These aspects require careful consideration before recording calls. The answer will depend on whether the company can apply the GDPR principles. Companies should consider:
Consent can appear straightforward as a lawful basis. However, it may not be the most appropriate, as there are strict requirements for valid consent, including that it must be freely given. If consent is not provided, the call must not be recorded.
Some sectors are required by law to record calls, for example parts of the insurance industry. In such cases, legal obligation should be evaluated to confirm it covers the intended recording. Legitimate interests may also be relevant following a balancing test.
When a company plans to record calls, it must ensure that the processing of personal data complies with GDPR. This means taking several concrete steps to address both legal and practical requirements. Key steps include:
By following these steps, companies can reduce the risk of infringements while building trust with customers and employees.
CONTRACTS GOVERNING PROCESSING
References to GDPR agreements between companies often mean a data processing agreement or a joint controllership agreement. It can also refer to a data transfer agreement governing the conditions for a transfer of personal data between two separate controllers. These agreement types help ensure compliance with the Regulation.
A data processing agreement must be in place where a company acting as a processor processes personal data for a company acting as a controller. The agreement must be in writing and describe the parties’ obligations regarding the handling of personal data, and GDPR lists the matters that must be covered. Among other things, it should set out:
When transferring personal data to another company, it is also important to transfer only the data that is necessary for the specific purpose and to inform data subjects about the transfer. Documentation of the processing is central to meeting GDPR’s accountability requirements.
A joint controllership agreement is required where two or more companies are joint controllers, meaning they jointly determine the purposes and means of processing. Such an agreement defines each party’s responsibilities and roles in relation to the joint processing, including:
It is also important to document and communicate these responsibilities internally within the organisations and externally to data subjects, for example through privacy notices. Joint responsibility means all parties can be liable for damage caused by the processing, which makes clear contractual provisions particularly important.
A data transfer agreement is often used when personal data (or other sensitive information) is transferred to another company and is intended to ensure the transfer complies with applicable data protection laws and regulations.
In general, when transferring personal data, consider information security in connection with the transfer, for example encryption in transit. This is a recurrent issue in gdpr compliance for saas companies given vendor ecosystems and frequent integrations.
Our solutions are tailored to your needs. Whether you are a small business tackling your first GDPR question or looking to take the next step with ongoing support, we are ready to help. Our services include:
Contact Morling Consulting for an initial meeting at no cost. Let us help you not only meet GDPR requirements but also use data protection as a competitive advantage in your business. We operate across Europe.
Yes. GDPR applies to all companies that process personal data — regardless of size, sector or scale. There are no exemptions for small businesses. Even if processing is limited, the company must follow the requirements of the Regulation.
GDPR contains a wide range of requirements, and Morling Consulting helps map how they apply in your operations. To comply, companies should, among other things:
A data processing agreement is required where a company engages a third party to process personal data on its behalf.
Example: A company engages an IT provider to store customer data on its behalf. The agreement must regulate responsibilities, security measures, incident reporting and more, in line with GDPR.
It depends on the purpose of the recording and your lawful basis. Before recording, you must:
Remember that if your lawful basis is consent, it must be freely given, informed and easy to withdraw.
Consequences can be serious. The Data Protection Authority can issue:
Beyond this, the company risks reduced trust from customers and partners.
Yes. If your company collects personal data via the website — for example through contact forms, newsletters or cookies — you must have an accessible, clear privacy notice. It should explain:
It depends on the purpose of processing. Common lawful bases include:
Selecting the right lawful basis is critical — Morling Consulting’s GDPR lawyers can help assess your specific processing, including gdpr guidance for small businesses and gdpr for businesses with complex vendor landscapes.
It depends on the type of processing you carry out. Under GDPR, a Data Protection Officer is required if:
If you are not legally required to appoint a Data Protection Officer, it may still be beneficial to have external data protection support — for example from Morling Consulting.
Yes. If you do not have the right expertise or resources internally, you can appoint an external Data Protection Officer. Morling Consulting can take that role and help to:
This offers assurance and continuity in data protection without building in-house capacity.
Advice is tailored to each company’s needs and maturity. Examples include:
Does your business need practical help with GDPR? Contact us to discuss
"*" indicates required fields
