Find the holes before they become a GDPR breach.

The ones that touch personal data, not your whole estate. That means web apps and their APIs, mobile apps, the cloud, the internal network, and the places the data actually ends up: databases, backups and file stores.

We scope from your record of processing activities (Article 30), which already sets out what you process, why, and who receives it. What the record does not say is which systems it lives in, so we walk that part with you in the introductory meeting, one system at a time, instead of testing everything or guessing.

Our recommendation is after you have written it and before the processing goes live. A DPIA sets out the security measures planned for high-risk processing (Article 35(7)(d)); the pentest checks whether those measures hold up and produces the technical proof that sits alongside that assessment.

There is no date to give here, and we will not invent one. What GDPR does say is that the assessment gets reviewed when the risk changes (Article 35(11)), and that is your cue to test again: a change in the processing, not a date in the diary.

No. A pentest finding is a vulnerability, not a breach. The 72 hours start with a breach of security that destroys, loses or alters personal data, or leads to unauthorised disclosure of or access to it, and it is reported unless it is unlikely to put the people affected at risk (Articles 4(12) and 33). Finding the route in before an attacker does is the opposite.

There is one exception, and we flag it as soon as we see it: if the test turns up traces that somebody has already been inside, that may be a breach. Reporting is your call with your counsel; we supply the technical evidence.

You, and whoever you choose. We do not publish it, pass it on or use your name as a reference without your permission. Even the sample report never goes out by email; we walk you through it on a call.

The people who ask for it are usually not certification auditors: your Data Protection Officer, a customer exercising its audit right over you as a processor (Article 28(3)(h)), or the supervisory authority. All three get the same thing: the report, the retest with the closure documented, and the platform export with every finding and its audit trail.

As long as the risk allows, because GDPR names no deadline. Article 32 asks for measures that match the risk and for regular testing of how well they work, so what stands up to an auditor is not speed: it is having prioritised well and being able to show it (Article 5(2)).

The report ranks the fixes by real impact, and the retest is included, at no cost and with no time limit. When you close something, we verify it and document that it is closed. There is no window for you to miss.

No. We do not act as your Data Protection Officer, run your privacy programme or give legal advice, and there is no GDPR certificate for us to issue: GDPR is a law, not a certification scheme. We perform the penetration testing that evidences the security of the personal data you process. Many clients pair us with their DPO or legal counsel, and the roles fit together cleanly.

Yes. We walk you through it on the call, so you can see the level of detail, the clarity of the reporting and the evidence format, and ask about whatever matters to you. We do not email it out on its own.