Data and artificial intelligence: being compliant, and staying so
The GDPR applies from the first customer file, and the AI Act applies from the first AI tool you use, even without having developed it. I document, I correct, and I can hold the mandate of data protection officer.
Brussels Bar lawyer since 2021, Certified data protection officer (Maastricht), Published fees
Why it matters
A company of five people is concerned by the GDPR as soon as it keeps a customer file, employs staff or publishes a contact form. Three items hold the whole together: the records of processing activities, the information given to individuals and the contract with each processor.
The AI Act also targets deployers: companies that use a tool without having designed it. Sorting CVs, scoring customers or monitoring employees with AI brings its own obligations: human supervision, information, retention of logs. The transparency obligations have applied since 2 August 2026. Proposed postponements affect the timetable for high-risk systems, which I check on the day of the consultation.
Your large-account clients ask for these documents before signing, and the Belgian Data Protection Authority asks for them after a complaint. I draft them, I keep them up to date and I put your position to the authority if an investigation opens. What you entrust to me stays covered by professional secrecy.
Typical situations
-
An SME of 40 people recruiting with an automated CV screening tool
It would need to qualify the processing, inform candidates and staff, check the supplier's role and provide for human supervision. It would also document the absence of a fully automated decision (article 22 of the GDPR).
-
A medical practice receiving an access request from a former patient
It would need to answer within the month, record its reply and have an internal procedure; without that, a complaint could open a wider investigation.
-
A marketing agency using an American emailing tool
It would need to frame the transfer outside the Union with standard contractual clauses and assess the level of protection of the destination country.
-
An online retailer losing the contents of its customer database
It would need to assess the risk, notify the authority within 72 hours if that risk exists, and inform the individuals concerned.
-
A SaaS publisher receiving an 80-question security questionnaire from a banking client
It would need to answer with up-to-date records, a compliant processing agreement and, if NIS2 applies to its client, documented measures. Otherwise the sale would wait.
What is included
-
Compliance audit
Mapping of processing activities, gaps identified, prioritised remediation plan, report in ten sections.
-
Records of processing activities
Drafting, update templates and instructions for your teams.
-
Public documents
Privacy policy, cookie policy, information notices, banner specification.
-
Impact assessment
For high-risk processing: description, assessment, measures adopted.
-
AI transparency and usage policy
AI Act notices, human review procedure, internal policy on the use of AI tools, note to staff.
-
NIS2
Applicability review, mapping, remediation plan.
-
Data protection officer mandate
Designation with the authority, monitoring, replies to requests, annual report. Three monthly options below.
How it works
- 01
Scoping
A 45-minute video call to set out the problem and the options.
- 02
Written quote
Scope, fixed price and indicative deadline, before any work starts.
- 03
Delivery
I draft, negotiate or file, and I keep you informed.
- 04
Handover
Annotated deliverables, points to watch and the next deadlines.
Why a lawyer as data protection officer
-
Professional secrecy over your exchanges
Article 458 of the Criminal Code: what you entrust to me stays covered.
-
Professional indemnity insurance of the Bar
Collective policy taken out by the Bar, in force for every matter.
-
Independence and absence of conflict of interest
Required by articles 38 and 39 of the GDPR, controlled by the rules of the Bar.
Three ranges, a price fixed before the work starts
The firm uses artificial intelligence tools for research and first drafts, under a lawyer's control. The time they save is not billed: it is already reflected in these ranges.
- Get compliantA website, an app or an AI tool to put in order quickly.Privacy and cookie policies, AI transparency notices, data processing agreement, internal AI use policy.€890 to €1,450
- Take stockYou want to know, in writing, where you stand.GDPR and ePrivacy audit, record of processing, impact assessment, AI Act diagnosis for one system, international transfers.€1,500 to €3,400
- Compliance programmeSeveral AI systems, NIS2 or a regulated sector.Full AI Act gap analysis, NIS2, implementation plan and follow-up.From €4,000
The exact price depends on your matter. You receive it in writing after the first contact, which is free, and it does not change afterwards without your agreement. Amounts exclude VAT; official fees and disbursements are extra.
All ranges and how billing worksFrequently asked questions
Forty-five minutes to scope the matter, €120 excl. VAT
-
A 45-minute video call, prepaid.
-
A written report in five points within 24 working hours: the problem as you put it, the options, my recommendation, the budget for what follows, the timing.
-
If you instruct me within 30 days, the €120 is deducted from the fee.