# GDPR/Data Protection Project: Tips to get Started

> A foundational data protection project aiming for company-wide compliance should begin with an initial GAP analysis to identify which documents, policies, processes, and structures are already in place.

- Source: https://www.sidd.swiss/en/insights/gdpr-data-protection-project-tips-to-get-started/
- Language: en
- Published: 2022-01-04
- Last updated: 2025-03-25
- Author: Philipp Staiger
- Publisher: SIDD Institute for Data Protection and Data Security, a brand of Priverion GmbH, Zugerstrasse 32, 6340 Baar (ZG), Switzerland

## The Data Protection Project

A basic data protection project aimed at achieving company-wide compliance should begin with an initial GAP analysis to assess which documents, policies, and processes are already in place. Based on this analysis, existing gaps can be identified, and a structured project plan can be developed. The first step typically involves creating or updating the core data protection documents and foundational processes, laying the groundwork for further implementation and compliance.

## The GAP Analysis

The GAP analysis and assessment of the current situation are carried out through workshops, interviews, and the review and analysis of existing documents.

- Preparation and completion of the necessary data processing agreements (DPAs)
- Preparation and conclusion of the necessary contracts for the transfer of personal data within a group of companies
- Creation of a privacy handbook containing all required guidelines and processes, as well as the governance structure. The structure includes the responsibilities assigned to the respective roles within the company.
- Preparation of the list of processing activities
- Determination of the risk of data processing to the rights and freedoms of data subjects (Data Protection Impact Assessment – DPIA)
- Creation of a risk treatment plan with technical and organizational measures
- Creation and implementation of a testing concept to ensure continuous improvement of the level of data protection (PDCA cycle)

In practice, it is advisable to use a software solution from the very beginning of the project in order to create the required documentation and processes. This reduces implementation costs by lowering overall project expenses.

---

This document is the Markdown rendition of the page linked above. Please cite the HTML URL.