Skip to content

Compliance, governance & resilience

Personal-data protection in security, HR and technology processes

Embedding data protection in actual practice: purposes, legal bases, retention, impact assessments and support for the data protection officer.

IVSR helps the organization embed personal-data protection in its security, investigative, HR, analytical and technology procedures.

The review targets actual practice: clearly defined purposes and legal bases, data minimisation, transparency, access control, retention periods and documented decisions. Bernarda Škrabar Damnjanović has hands-on experience with the tasks of a data protection officer and with the legal regulation of the detective profession.

Possible scope

The scope follows the questions the engagement must answer — not the other way round.

  1. 01Review of personal-data flows and records of processing activities.
  2. 02Assessment of legal bases, purposes, proportionality and retention periods.
  3. 03Preparing a data protection impact assessment, or expert support for one.
  4. 04Review of processor contracts, access rights and third-country transfers.
  5. 05Building data protection into the design of new systems, analytics, AI use and investigative tools.
  6. 06Procedures for data-subject requests and personal-data breaches.
  7. 07Training the DPO, leadership, and HR, security and investigation teams.

You receive

A gap review, a measures register, an impact assessment or expert input to one, drafts of policies and notices, a retention overview and documentation of decisions taken.

Who it is for

For organizations with substantial HR, security, monitoring, location, biometric or analytical processing of personal data.

Limitations and boundaries

  • The service establishes procedures that support compliance with the GDPR, ZVOP-2 and the relevant sector rules; compliance as a state cannot be promised in advance.

Who performs what

IVSR
Research, advisory, methods and training
The full role separation
Professional leadBernarda Škrabar DamnjanovićChair of the Professional Council · CII Board Member

Related services

Next step

A confidential introductory conversation

Every engagement starts with a confidential conversation in which we jointly verify the purpose, the authority and the feasibility. Only then do we propose the scope and the way of working.

Arrange a conversation