GDPR compliance and personal data protection for business

GDPR makes a data protection officer mandatory for public authorities, for organizations whose core activities involve large-scale regular monitoring of people, and for those processing special category data such as health data on a large scale; in all three cases CloudHosting's specialist can take the duty on as an outsourced DPO. The regulation does not define large scale precisely, so borderline cases need an honest assessment of what you actually process and why. Even when no DPO is required, every GDPR duty still applies: records, legal bases, security and breach handling. Our specialist covers both situations, taking the mandatory duty or supervising compliance voluntarily. If you are unsure which side you fall on, describe your processing to us and we will assess it.

GDPR allows fines of up to 20 million EUR or 4% of worldwide annual turnover, whichever is higher, for the most serious violations, and CloudHosting's specialist keeps in order the records and safeguards an authority weighs when it sets the amount. In practice the authority looks at the gravity and duration of the violation, how many people were affected, whether you cooperated and what safeguards you already had in place, so documented compliance work directly influences the outcome. A fine is also not the only consequence: the authority can order you to change or stop specific processing, and the case becomes public, which clients and partners notice. For most companies keeping records, policies and training in order costs a fraction of even a modest enforcement case.

The Article 30 register is the GDPR record of your processing activities, and CloudHosting creates it during the processing inventory and keeps it current as part of the service. It lists which categories of personal data you handle, for what purposes, on what legal basis, who receives the data and how long you keep it. GDPR obliges most organizations to maintain it, and the exemptions are narrow enough that relying on them is rarely wise. It matters because it is the first document a supervisory authority requests, and because everything else, from privacy policies to retention rules, is built on top of it. A register is only useful while it reflects reality, so it must be updated whenever a process, system or vendor changes.

Video surveillance in Latvia counts as personal data processing under GDPR, and CloudHosting prepares the signage and documentation it requires, in Latvian where Latvian law requires it. Cameras must serve a defined lawful purpose, typically the protection of property or people, and must not cover more than that purpose justifies, which is why pointing them at neighboring property or areas where people expect privacy causes problems. Monitored areas need signage that names the operator and the purpose, so visitors know who is filming and why. You must also document how long footage is stored, who may access it and on what grounds, and the surveillance itself belongs in your Article 30 register.

CloudHosting's data protection retainer is a fixed monthly fee for which our specialist works as your standing data protection function instead of a one-off consultant. Month to month that means keeping the Article 30 register current, reviewing every new processing activity before you launch it, such as a new tool, vendor or marketing campaign, running staff training and guiding you through incidents. Where the law requires a DPO, the retainer covers that duty as well, including being the named contact for the supervisory authority. Compliance is not a document you finish once, because your processing keeps changing, and the retainer exists to absorb that change. The fee is quoted per company once we have seen the scope of your processing.

CloudHosting quotes data protection per company, as a one-off project for the inventory and documents or as a fixed monthly retainer that also covers the DPO duty where the law requires one. There is no public price list because the work depends on how many processing activities, systems and vendors you have, and on how much documentation already exists. To name a fixed figure we first look at the scope: what personal data you process, for what purposes and where it lives. Once agreed, the retainer stays the same every month, and new processing activities are reviewed within it rather than billed as surprises. Describe your organization briefly and you get a quote before committing to anything.

CloudHosting's data protection service covers GDPR duties around personal data, which apply to almost every company, while its NIS2 service covers the cybersecurity of organizations in the sectors the directive lists. NIS2 asks whether your infrastructure is resilient, whether incidents are reported on time and whether technical controls are in place. Data protection is about records, legal bases, policies and people's rights, regardless of sector or size. The overlap is security: both expect you to protect the data you hold, so work done for one often supports the other. Many clients need both, and together with our IT audit the services complement each other. If you are unsure which applies, ask us.

CloudHosting sets up data protection in a fixed order, inventory first, then documents and training, and a small company with a handful of processes gets its base set quickly. There is no honest universal deadline, because the timeline depends on how many processing activities you have and how much documentation already exists. After the inventory we agree a document and training plan with clear deadlines, closing the riskiest gaps first, such as missing mandatory records or consent texts. Larger organizations are handled in stages so daily work is not disrupted. You can shorten the timeline by naming one contact person and collecting your existing contracts and policies before we start.

CloudHosting's data protection service covers both private companies and public institutions in Latvia, and for public bodies GDPR makes a data protection officer mandatory regardless of size. The officer must be able to act without a conflict of interest, which is difficult to arrange internally in a small institution where the same people run the systems being supervised. An outsourced DPO solves that: our specialist takes the duty on a retainer, keeps the required records, advises management and handles communication in data protection matters. All documents that Latvian law requires in Latvian are prepared in Latvian. If you represent an institution, write to us and we will agree the scope and the working arrangements.