§ 1
Who it is for
This service is for companies established outside the European Union that collect, process or monitor the personal data of EU residents. The GDPR applies regardless of where you are incorporated. If your platform serves European users or you handle the data of B2B clients in the EU, you have obligations that call for real legal analysis, not a compliance checklist. This service maps your data flows, establishes the lawful basis for each processing activity and produces the documentation you need to demonstrate accountability before a supervisory authority asks for it.
§ 2
Deliverables
GDPR compliance for a company outside the EU is a different exercise from that of a European entity: data flows are less obvious, the obligation to appoint a representative may apply, and contractual exposure to clients and processors in the EU calls for real legal analysis. This engagement maps your actual data exposure in the EU, produces the documentation that demonstrates accountability and brings your digital presence into line with European requirements. The result holds when a supervisory authority asks for it, before or after an incident.
A unilateral confidentiality agreement signed by PASSAS before the video consultation, available at no additional cost on request. It binds the firm alone — no signature is required from the client — and adds an explicit contractual layer on top of the professional secrecy obligations inherent to the practice of law.
A 60-minute working session by video call in which we analyse your situation, your specific needs and our ability to help you. We assess whether we can take on the matter and give you the fixed price in advance. You can book it directly through the Google Calendar link on our website and pay €90 by Stripe.
Legal analysis of the business model that determines which rules affect the company, what legal risks exist and what documentation is mandatory before operating. Covers the sectoral regulatory framework, data protection obligations, essential contracts and any applicable authorisation or licensing requirements.
The documentation required for GDPR compliance and, more broadly, for any rules on data protection and on the processing and transfer of data, including international transfers, both in dealings with users and with the providers that process data on your behalf, with the legal mechanisms needed to operate without regulatory exposure.
The legal documentation required to operate online: legal notice, privacy policy, cookie policy and, where applicable, terms of sale. Drafted with legal precision and adapted to the specific activity, not carried over from another website. Complies with the GDPR and with information society services rules.
§ 3
Timeline
At PASSAS we work fast, and we intend to be faster than the competition without losing quality along the way. That is why we like to tell you how long you will wait for your service. It is an indicative figure, since some engagements are more complex than others. The Engagement Letter sets out a deadline tailored to your matter, one we will do everything we can to meet, or to beat. That is our commitment to quality.
§ 4
Fees
We tell you what you will pay for your service: at PASSAS we work with a transparent fee policy. That said, we are not a marketplace. Every service is tailored and the fees follow the workload borne by the lawyer in charge. Even so, we want to give you an indicative price for this service, so that deciding to instruct us and booking your virtual consultation is easier.
§ 5
Frequently asked questions
Yes, where it offers goods or services to people located in the Union or monitors their behaviour, regardless of where the company is incorporated and of whether it charges for the service. That is the test in article 3(2). Establishing whether your activity falls within it, and how far, is the first part of the engagement.
Article 27 requires it of controllers and processors outside the Union that fall within the Regulation, subject to a narrow exemption for occasional processing that does not involve special category data on a large scale and is unlikely to result in risk. The exemption is invoked more casually than its wording allows, and relying on it takes a documented analysis rather than an assumption.
It depends on whether the Commission has adopted an adequacy decision. Where it has not, transfers rest on standard contractual clauses supported by a transfer impact assessment, a requirement that follows from the Schrems II judgment. For the United States, the EU-US Data Privacy Framework is also available to certified entities. The engagement establishes which basis supports each flow and leaves the supporting documentation built.
Software organises records and automates notices. What it does not resolve is the legal characterisation underneath: what data you process, on what lawful basis, in which contractual role, and under which supervisory authority. That determination is signed by a lawyer admitted to the Bar, carries professional liability and is covered by legal professional privilege. It is also the part a supervisory authority will test.
From €3,500 + VAT, delivered within two weeks, at a fixed price agreed in the engagement letter before you pay. The exact figure depends on the number of processing activities and the complexity of your international flows. If your situation fits, you can book a 60 minute Virtual Consultation for €90 (VAT included), deductible from the first invoice if we go on to accept the engagement.
Email us at hola@passas.io, no strings attached, or fill in the form below and we will reply within 24 hours:
§ 6
Related articles
We know how much it matters that the lawyer you instruct has real command of the subject you are handing over. We have written on questions related to the service you are considering.
The Data Act reaches any SaaS provider with customers in the EU. What a company outside Europe has to change in its contracts before 12 January 2027.
60 minutes on Google Meet with a qualified lawyer specialising in TechLaw, litigation or international law. €90 including VAT, deducted from the first invoice if we take on your matter. You leave with legal judgement and a fixed price for whatever comes next.
