Data protection and AI
GDPR and AI Act compliance for digital businesses
An EU GDPR representative for companies outside the EU, GDPR documentation, DPIAs, an external data protection officer and EU AI Act assessments.
Services
Data protection packages and services
EU GDPR representative
For companies outside the EU that offer goods or services to people in the EU or monitor their behaviour. We act as your representative under Article 27 GDPR and as the contact point for supervisory authorities and individuals.
€149 per month
Billed annually. Available where the people whose data you process include people in Slovenia.
Book a consultation →
GDPR for websites
Privacy policy, cookie policy, notices next to forms and the configuration of cookie consent.
from €450
Basic case: a presentation website with one form.
Book a consultation →
GDPR for operations
Record of processing activities, retention periods, procedures for data subject requests and data breaches, and a review of your processor contracts.
from €700
Basic case: a small company with up to five processors.
Book a consultation →
Comprehensive GDPR
The website and operations packages together, plus a short training session for your staff.
from €1,300
Basic case: a small company with a presentation website.
Book a consultation →
Data protection impact assessment (DPIA)
An assessment of the impact on the protection of personal data where processing is likely to result in a high risk to individuals’ rights (Article 35 GDPR).
from €600
Basic case: one type of processing.
Book a consultation →
External data protection officer (DPO)
We take on the tasks of your data protection officer under Articles 37 to 39 GDPR and act as the contact point for the supervisory authority.
from €300 per month
Up to 3 hours per month are included. The independence of the function is set out in a separate annex to the contract.
Book a consultation →
EU AI Act
An assessment of which obligations under the EU AI Act apply to your product, and preparation for compliance.
from €500
Basic case: assessment of obligations for one product.
Book a consultation →
International data transfers
Standard contractual clauses, transfer impact assessments and a review of the vendors to which you transfer personal data outside the EU.
Price after scoping
Depends on the number of vendors and destination countries.
Book a consultation →
Prices apply to the basic case described. All prices are in euros (EUR). No VAT is charged under Article 94(1) ZDDV-1. Business clients in other EU Member States account for VAT under the reverse charge. Company size discounts do not apply to the EU GDPR representative. For other services, small companies receive a 10% discount, micro companies and startups 20%. Discounts do not stack. We determine company size using the criteria in Article 55 of the Slovenian Companies Act (ZGD-1), applied by analogy to sole traders and to companies outside Slovenia. Startups are innovative young companies less than three years old, as assessed by us.
Knowledge Center
Data protection and AI videos
The GDPR, EU representatives, DPIAs, international transfers and the EU AI Act, explained in a few minutes.
Digital Law
Do You Need an EU Representative? (GDPR Article 27)
Watch the video and read the article →
Digital Law
Can You Train AI on Your Customer Data? (GDPR)
Watch the video and read the article →
Digital Law
Is Your Cookie Banner Legal in the EU? (60-Second Test)
Watch the video and read the article →
Digital Law
Is Cold Email Legal in the EU? GDPR Rules by Country
Watch the video and read the article →
Digital Law
Can You Use US Cloud Tools Under the GDPR? Transfers, SCCs and the Data Privacy Framework Explained
Watch the video and read the article →
Process
How we work together
01
Free consultation
In 30 minutes we look at your product and data flows and tell you which package you need.
02
Written offer
You receive an offer with the scope and the price, and a short list of the information we need from you.
03
Documents and support
We prepare the documents with you, handle your comments and remain available for follow-up questions.
Questions
Frequently asked questions
Do we need an EU representative?
If your company is not established in the EU but offers goods or services to people in the EU, or monitors their behaviour in the EU, Article 27 GDPR requires you to designate a representative in the EU in writing. The exceptions are narrow: occasional processing that does not include large-scale processing of special categories of data or data on criminal convictions and is unlikely to result in a risk to individuals, and processing by public authorities or bodies.
Can you be our representative if we have no users in Slovenia?
No. The representative must be established in one of the Member States where the people whose data you process are. If your users or customers in the EU include people in Slovenia, we can act for you.
Do we need a data protection officer?
Under Article 37 GDPR a DPO is mandatory for public authorities and bodies, and for companies whose core activities consist of regular and systematic monitoring of individuals on a large scale, or of large-scale processing of special categories of data or data on criminal convictions and offences.
When is a DPIA mandatory?
Before you start processing that, taking into account its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of individuals, in particular where it uses new technologies (Article 35 GDPR). We check this in a short screening first.
Does the EU AI Act apply to companies outside the EU?
In certain cases, yes. It applies to providers that place AI systems on the EU market or put them into service in the EU, wherever they are established, and to providers and deployers outside the EU where the output of the AI system is used in the EU. Which obligations apply depends on your role and on the risk category of the system.
Ready to talk?
Book a free 30-minute consultation and together we will assess how we can help you.
Book a free consultation