Legal skills

Personal data law & GDPR

With more than thirty years of experience, Derriennic Associates has established recognized expertise in personal data protection. The firm began addressing regulatory issues and challenges in this field at a very early stage. Since 2016, we have been assisting an increasing number of private and public actors in achieving GDPR compliance. To support this growing demand, the firm rapidly established a dedicated GDPR team, which expanded further in 2018 with the arrival of several new members, including a former legal expert from the French Data Protection Authority (CNIL).

Thanks to their solid understanding of business environments, the firm’s lawyers integrate seamlessly into their clients’ teams when handling in-depth GDPR compliance projects. Derriennic Associates has also built strong partnerships with cybersecurity, IT systems and data analysis specialists, enabling the firm to offer comprehensive, end-to-end support combining legal expertise with technical insight.

The firm offers a wide range of services, which can be deployed at any stage of the GDPR compliance process, including:

risk and processing mapping,
compliance audits,
definition and implementation of governance frameworks,
creation of internal compliance procedures (exercise of rights, data breach notifications, etc.),
privacy impact assessments (PIAs),
regularisation of service provider contracts,
management of cross-border data flows,
data retention and deletion policies,
and more.

The firm has also developed a Data Protection Officer (DPO) service for organisations wishing to outsource this function. The DPO is the “compliance architect” for personal data protection within an organisation. Their duties include:

informing and advising the data controller (or processor),
monitoring compliance with the GDPR and national legislation (in France, the Data Protection Act),
advising on and verifying the performance of data protection impact assessments,
cooperating with the supervisory authority (CNIL in France) and acting as its point of contact.

The DPO’s remit covers all processing operations carried out by the appointing organization. Supported by a dedicated personal data protection team, the firm carries out these DPO functions on behalf of its clients. Accordingly, depending on each client’s needs, the services provided by Derriennic Associates are varied and can be integrated at every stage of the GDPR compliance process.

Team : Alexandre FIEVEE, François-Pierre LANI, Anne COUSIN, Géraldine PACAUT, Alice ROBERT, Sophie DUPERRAY, Valentin VAUGE, Alexandre RENOU, Gaétan DUFOULON,