NIS 2 Compliance

The GDPR applies to any organization—public or private, regardless of its size —as long as it processes personal data, provided that:

• it is established within the European Union;
• or its business is directly aimed at European residents.

Small businesses, SMEs, nonprofit organizations, and local governments: no one is exempt. This applies to you if you manage your employees’ HR data, process customer or prospect data, or outsource these operations on behalf of another organization.

Personal data is any information that allows a natural person to be identified, either directly or indirectly:

• Immediately: last name, first name, photo;
• Indirectly: phone number, customer ID, IP address, voice.

Identification may be based on a single piece of data (for example, a Social Security number) or on a combination of several pieces of information (for example: gender, city, year of birth, subscription, membership in an organization). As soon as a link to a natural person is possible, the data is personal—and the GDPR applies.

The appointment of a Data Protection Officer (DPO) is mandatory in three cases defined by Article 37 of the GDPR:

1. The organization is a government agency or public body (local governments, ministries, etc.).
2. The core business involves regular, systematic, and large-scale monitoring of individuals (banks, insurance companies, internet service providers, etc.).
3. The core business involves the large-scale processing of sensitive data (health, criminal records, etc.), similar to what is done in hospitals.

Please note: Regardless of the situation, every organization remains obligated to comply with the GDPR, whether or not a data protection officer has been appointed. The CNIL strongly recommends appointing a data protection officer in other cases—it is the best way to structure and document your compliance.

FeelAgile offers an outsourced DPO service for organizations that do not wish to hire an in-house DPO.

Yes. The record of processing activities is mandatory for all organizations (Article 30 of the GDPR), whether public or private, regardless of their size. For each processing operation involving personal data, it lists: the purpose, the legal basis, the categories of data and data subjects, the recipients, the retention periods, and the security measures.

Provisions for Organizations with Fewer Than 250 Employees

Companies with fewer than 250 employees are exempt from the requirement to maintain a record: they are only required to record the following processing activities:

• non-recurring tasks (payroll management, customer/prospect management, supplier management, etc.);
• that may pose a risk to rights and freedoms (geolocation, video surveillance, etc.);
• involving sensitive data (health information, criminal records, etc.).

However, we recommend that you document all of your processing activities. This will give you a comprehensive overview of the personal data you process and allow you to identify corrective actions in the event of an audit. The record of processing activities is one of the first deliverables we establish during a GDPR engagement.

Any personal data breach (leak, loss, unauthorized access, ransomware, etc.) must be reported to the CNIL within 72 hours, unless it poses no risk to individuals. When the risk is high, the affected individuals must also be notified.

An effective response requires a pre-established procedure:

1. Incident classification and documentation.
2. Notification to the CNIL (and to individuals, if necessary).
3. Corrective Action Plan.

Our outsourced DPO service includes comprehensive management of these situations.

The CNIL may issue warnings, formal notices, and financial penalties of up to 20 million euros or 4% of annual global revenue —whichever is higher.

In addition to the fine, penalties may include an order to comply, public disclosure of the decision, and a temporary or permanent restriction on data processing. The reputational and commercial risk is often more severe than the penalty itself.

It all depends on your current level of readiness and the scope of your data processing activities. As a general rule, achieving full compliance takes between 3 and 9 months.

With FeelAgile’s agile method, our clients achieve operational compliance in less than 4 months on average, thanks to a sprint-based approach and a priority focus on high-risk areas (cookies, records, third-party service providers).

The budget depends on the size of the company, the number of data processing operations, and whether or not there is an in-house DPO.

As a general guide, the initial cost of achieving compliance for an SME typically ranges from €8,000 to €25,000, to which may be added a flat fee for an outsourced DPO (starting at a few hundred euros per month).

FeelAgile will provide you with a personalized quote following a free 30-minute scoping audit.

These standards are complementary:

• GDPR: European legal framework for the protection of personal data;
• ISO 27001: international standard for information security;
• ISO 27701: an extension of ISO 27001 focused on privacy, providing an excellent technical foundation for demonstrating GDPR compliance;
• HDS: Mandatory certification for health data hosting providers, with stricter requirements.

FeelAgile can help you implement an integrated data governance system that covers these various data repositories while avoiding redundancies.

Implementing the GDPR requires expertise in information technology, law, and risk management, as well as a solid understanding of the laws applicable to your industry.

You can:

• Hire or train an in-house DPO with the necessary skills;
• Hire an external DPO who can audit, advise, and oversee compliance efforts.

The process of achieving GDPR compliance is a significant undertaking that should not be overlooked. Please feel free to contact FeelAgile for an initial consultation and expert guidance.