Direct answer: the first question to ask a GDPR consultant is "how far does the GDPR apply to me, and am I a controller or a processor in each line of business?" For a Taiwanese company with no establishment in the EU, the GDPR applies only where it offers goods or services to people in the EU, or monitors their behaviour as far as it takes place in the EU (Article 3(2)); controllers and processors also have different obligations (Articles 24 and 28). Get this wrong and the documents and contracts that follow must be redone. Next, check whether the consultant can turn records of processing activities, data protection impact assessments, 72-hour breach notification and transfer mechanisms into a system that actually runs, sharing one document set with Taiwan's Personal Data Protection Act and ISO 27701.
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Scope | Which of my activities fall under Article 3(2)? How do you judge "offering goods or services" and "monitoring behaviour"? |
| Controller or processor | In each line of business, am I a controller, a joint controller or a processor? How must the contracts follow (Articles 26 and 28)? |
| EU representative | Do I need to designate a representative in the EU under Article 27? |
| Records and impact assessments | Who prepares the Article 30 records of processing activities and the Article 35 data protection impact assessments, and how often are they updated? |
| Breach notification | For the current 72-hour notification under Article 33, who decides whether to notify? To which Member States' supervisory authorities (without an EU establishment there is no one-stop shop)? |
| International transfers | Taiwan currently has no EU adequacy decision. Is sending data from the EU to Taiwan a "transfer" under Chapter V (collecting it directly from people in the EU usually is not)? If it is, which Article 46 safeguard applies? Do the current standard contractual clauses work for a company that is itself subject to Article 3(2)? |
| Integration with Taiwan's law and ISO 27701 | Can one system cover the GDPR, Taiwan's Personal Data Protection Act and ISO 27701 at the same time? |
| Who leads, and named cases | Who actually runs the engagement? Do you have personal data protection cases that clients have agreed to publish? |
When you may not need a consultant
If you have no establishment in the EU and are certain you do not offer goods or services to people in the EU or monitor their behaviour there, the GDPR usually does not apply to you directly. If you are only a processor and your customer has provided a complete data processing agreement, having your legal team review the contract and implementing the security measures it requires may be enough; but if the processing you carry out itself falls under Article 3(2), the processor has its own legal obligations, such as designating an EU representative (Article 27, with exceptions), keeping records of processing (Article 30(2)) and notifying the controller of a breach (Article 33(2)).
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Scope and roles: we inventory personal data types, sources, purposes, retention periods and recipients, and determine the GDPR scope and your controller and processor roles
- Records and impact assessments: records of processing activities meeting Article 30, mapped to Taiwan's Personal Data Protection Act at the same time; data protection impact assessments for high-risk processing
- Rights requests and breach notification: privacy notices, consent management and procedures for data subject requests, with 72-hour breach notification drills
- International transfers: we assess whether a data protection officer is needed, help review standard contractual clauses and keep transfer records
- Integration with Taiwan's law and ISO 27701: an ISO 27701 privacy information management system as the framework, so one system covers both the GDPR and Taiwan's Personal Data Protection Act
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced
- Named cases: clients published with their authorisation for personal data protection consulting include the Joint Credit Information Center (JCIC), Lativ, Cho Yuan and Hypercore Fitness Center (Hypercore case)
Related questions
- Do I have to appoint a data protection officer (DPO)? Not necessarily. Under Article 37(1), a DPO is mandatory in three cases: processing by a public authority or body (except courts acting in their judicial capacity); core activities that require regular and systematic monitoring of data subjects on a large scale; or core activities consisting of large-scale processing of special categories of data under Article 9 or criminal conviction data under Article 10. For private companies the last two matter. Otherwise it is your choice, although EU or Member State law may require one (Article 37(4)). GDPR consulting
- Will the 72-hour deadline change? The Digital Omnibus proposal the European Commission tabled on 19 November 2025 (procedure 2025/0360(COD)) would extend the deadline for notifying the supervisory authority to 96 hours and raise the notification threshold; the proposal is still in the legislative process, and the deadline today remains 72 hours. GDPR consulting
- How does ISO 27701 relate to the GDPR? ISO 27701 is the international standard for privacy information management systems and can turn GDPR obligations into an auditable management system; but ISO 27701 certification does not by itself mean legal compliance with the GDPR. How to choose an ISO 27701 consultant in Taiwan
- How long does GDPR consulting take? The basic set-up (records of processing, privacy notices, procedures for rights requests) usually takes two to three months; with ISO 27701 certification it takes five to eight months. GDPR consulting
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.