Data management is now one of the most sensitive and strategic aspects for companies. The progressive digitization of processes, the adoption of new technologies, the rise of online services and the increasing attention of regulatory authorities require a robust and structured approach to privacy and data protection advisory.
Andersen’s Privacy and Data Protection team supports companies, organizations and entities, including those operating internationally, in defining governance models that comply with EU Regulation 2016/679 (the GDPR), the Italian Privacy Code, the Data Act (EU Regulation 2023/2854), and all national and European legislation related to data management. Our advisory comprises legal, tax and corporate compliance expertise, with a focus on cases of administrative liability under Italian Legislative Decree 231/2001 and, more generally, risk management, ensuring comprehensive and customized solutions.
Privacy and data protection advisory services for businesses
Our approach combines legal analysis with a strategic business view, supporting clients in all phases of designing, implementing and monitoring business processes involving data, including personal data.
The main services we provide are as follows:
Regulatory compliance with GDPR and the Italian Privacy Code
- GDPR advisory for companies, conducting preliminary analysis of personal data processing carried out by the organization;
- Drafting and updating disclosures, processing records, internal policies and operating procedures;
- Assessment of the legal basis for processing and the principles of lawfulness, transparency and proportionality; Support in managing relationships with suppliers and partners, including preparing and reviewing contracts and Data Processing Agreements (DPAs).
Data Protection Officer (DPO) and Support Functions
Andersen attorneys provide Outsourced DPO services and assist Insourced DPOs in carrying out their duties:
- monitoring regulatory compliance
- managing relations with the Data Protection Authority
- internal staff training on privacy and cybersecurity issues
- support in handling security incidents and data breaches
Data Protection Impact Assessment (DPIA) and Risk Management
For processing that poses high risks to the rights and freedoms of data subjects (e.g., in the context of whistleblowing or when introducing AI-based systems), we prepare comprehensive Impact Assessments (DPIAs), identifying appropriate technical and organizational measures to mitigate risks.
Data Breach and Cybersecurity Management
In the event of personal data breaches, we assist companies in notifying the Personal Data Protection Authority, notifying data subjects and preparing remediation plans.
We work with cybersecurity experts to strengthen protection systems and prevent future incidents. Effective management of security incidents and data breaches positively impacts the organization’s operations and reputation.
International Data Transfers (outside the EU)
We support clients in handling international data transfers to on-EU countries, by drafting:
- standard contract clauses (SCC),
- Binding Corporate Rules (BCR)
- Transfer impact assessments.
All in accordance with EDPB guidelines and European case law.
NIS Directive 2 Compliance: advisory and compliance for companies
The new NIS 2 Directive introduces strict obligations for companies operating in sectors considered critical (energy, transportation, healthcare, finance, digital technologies and others).
Our team provides NIS 2 advisory for companies and supports them in the adaptation process, offering:
- mapping of IT infrastructure and relevant information flows
- support in accessing the platform and filling out documentation
- definition of technical and organizational cybersecurity measures in line with the required standards
- drafting of internal policies for handling security incidents and notifications to the competent authorities
- integration of NIS 2 obligations into organizational models under Italian Legislative Decree 231/2001, so as to include cyber risks among those relevant to the entity’s liability
- management and staff training on governance duties and on senior management accountability
Using an integrated approach, enterprises can not only comply with regulations, but strengthen digital resilience and cybersecurity, ensuring business continuity.
Artificial Intelligence and Data Protection in the Workplace
The adoption of artificial intelligence systems in companies – from human resource management to performance monitoring, to productivity tools – entails significant privacy and compliance challenges.
The Privacy and Data Protection Team, working in synergy with the Employment & Labor Department, assists clients in analyzing and managing risks arising from the use of AI tools, specifically:
- assessing compliance with GDPR principles in using personal data for training and in using algorithms
- preparing DPIAs for AI systems that affect employees and contractors
- reviewing company policies related to overseeing work activities and using monitoring software
- establishing internal protocols to ensure transparency, fairness and equity in adopting AI solutions
- integrating AI governance measures with Legislative Decree 231 procedures to prevent the risk of violations of fundamental rights
This is how we promote the responsible use of AI that increases business efficiency without compromising worker privacy protection.
Integration with Organization and Management Models: privacy, cybersecurity, and AI
Violation of privacy regulations or information security obligations or the misuse of AI systems can generate consequences in terms of penalties as well as liability for the entity under Italian Legislative Decree 231/2001.
For this reason, Andersen integrates privacy advisory with the activities of Legislative Decree 231 compliance, designing organizational models that include data protection procedures, cybersecurity and rules for the use of AI technologies.
This integration enables companies to strengthen their overall regulatory compliance and protect their reputational assets.