Data Protection & Privacy
A clear legal basis, a DPIA where needed and safeguards built in before go-live.
The problem
New systems, vendors and data uses arrive faster than privacy teams can review them. Article 25 GDPR expects data protection by design and by default, and Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to people.
AI adds new routes for personal data: prompts and uploads, documents indexed for retrieval (RAG), training and fine-tuning data, and logs kept by the provider. Each route is processing under GDPR, and many are not in any record.
What we do
For each system, vendor or AI use we trace which personal data is collected, where it goes, who processes it and where it is stored, including prompts, retrieval indexes, training data and logs.
We set the purpose and legal basis under Articles 5 and 6, identify special categories of data under Article 9, and check where automated decisions under Article 22 may arise.
We screen each processing activity for the need for a DPIA under Article 35, using the supervisory authorities' lists, and carry it out where required, with risks and measures documented.
We review data processing agreements under Article 28, the vendor's own use of your data, retention and transfers outside the EU under Chapter V.
We turn the results into requirements for your projects and software lifecycle: minimisation, pseudonymisation, access control, default settings and retention limits under Articles 25 and 32.
We add each processing activity to your records under Article 30 and review DPIAs when the system, the vendor or the risk changes.
How we deliver
Our privacy consultants carry out DPIAs and advise your data protection officer and project owners on each decision, including for AI uses.
Learn moreOur engineers build the safeguards into your systems, such as sensitivity labels, data loss prevention, access control on RAG sources and pseudonymisation.
Learn moreWe review new systems and AI uses, keep DPIAs and the records of processing current and monitor how personal data flows into AI tools.
Learn moreFrameworks
Platform
When the Fidempli platform launches in December 2026, it applies the result in daily AI use: personal and health data is pseudonymised or removed before any AI model sees it, and each DPIA stays linked to the AI system it covers.
Explore the platform
No. Article 35 requires one where processing is likely to result in a high risk to people, for example systematic monitoring, large-scale processing of special categories or new technologies such as many AI uses. We screen each case and document the outcome either way.
Only where there is a purpose, a legal basis and a provider contract that fits. We help you set clear rules per tool and add technical controls, so the rule does not depend on memory alone.
That depends on the product, the contract and the settings. We review the terms and configuration of each provider and record what applies.
Documents indexed for retrieval and data used for training or fine-tuning are processing too. We check purpose, minimisation and access control, so the AI only returns what the user is allowed to see.
Capacity for DPIAs, AI-specific knowledge of how copilots, agents and RAG systems handle data, and engineers who implement the controls. Your data protection officer stays in charge of the decisions.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
