We start the GDPR compliance project by assessing the current privacy framework used in the organization. The short review of personal data categories, privacy risk assessment approach, and governance structure enables us to prepare a plan for the GDPR compliance project.

GDPR puts obligations on any organization processing personal data without explaining how to implement them. Here the ISO 27001-compliant Information Security Management System comes in handy, offering a state-of-the-art approach to managing information security and privacy. In this step, the ISMS is defined and introduced to the organization.

The ISMS is then extended with the approach to managing privacy derived from GDPR and other privacy regulations. ISO 27701 standard provides guidance on extending the ISMS to the Privacy Information Management System (PIMS). In this step, the PIMS is defined and introduced to the organization on top of the ISMS.

The organization under its PIMS executes the basic privacy processes in this step. It covers defining personal data categories, defining records of processing activities (ROPAs), conducting privacy risk assessments, and implementing technical and organizational measures (TOMs). Finally, data processing agreements and other legal documents are also prepared.

Finally comes the moment when both ISMS and PIMS are operated in the organization. ins2outs assures building the proper awareness among people engaged in personal data processing. It structures and triggers all actions required by both systems to ensure security, privacy, and lawful processing of personal data. If needed, a notified body can certify both ISMS and PIMS.