Applicable Standards
Intended Beneficiaries
- ✓Any enterprise that collects, processes, or transfers customer or employee personal data
- ✓Companies with EU customers or employees subject to GDPR requirements
- ✓High-risk, data-intensive sectors: financial services, healthcare, e-commerce
- ✓Companies that have suffered a data breach or are under regulatory investigation
Service Delivery Process (Four Stages)
Data Inventory & Data Mapping
Systematically catalog all personal data collection points, processing activities, and transfer channels to build a comprehensive data flow map.
Regulatory Gap Analysis
Map current practices against GDPR, ISO 27701, and Taiwan PDPA requirements to identify gaps and deliver a prioritized remediation plan.
Policy & Documentation Build
Design compliant consent mechanisms, privacy notices, and data subject rights SOPs to complete the full regulatory documentation set.
DPIA & Continuous Monitoring
Execute Data Protection Impact Assessments (DPIAs) for high-risk processing activities, and establish breach notification procedures and annual review cycles.
Frequently Asked Questions
We are a Taiwan company — why do we need to comply with GDPR?▼
If any of your customers, employees, or users are natural persons located in the EU, you are subject to GDPR regardless of where your company is incorporated. Non-compliance penalties reach €20 million or 4% of global annual revenue, whichever is higher.
What is a DPIA and when is it required?▼
A Data Protection Impact Assessment (DPIA) is required before launching new processing activities that are likely to result in a high risk to individuals. Common triggers include: large-scale personal data processing, use of new technology, and automated decision-making.
What should we do when a data breach occurs?▼
GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach (if it meets reporting thresholds). Winners helps you build complete pre-incident, incident response, and post-incident notification processes.
How should consent forms be designed to comply with regulations?▼
Compliant consent must: clearly state the purpose of collection, specify the data types, state the retention period, and provide a mechanism to withdraw consent. Winners provides GDPR- and Taiwan PDPA-compliant consent templates and review services.
Enquire About This Service
Privacy Information Mgmt (PIMS)
Request a Complimentary Consultation