GDPR · ePrivacy · EU AI Act · DSA · DMA

GDPR and EU AI Act consultancy for technology businesses

NWLexTech advises software companies, platforms and AI product teams on the European rules that actually reach their products — and produces the documentation their customers, app stores and regulators ask to see.

Discuss an engagement

Services

What we do

Fixed-fee advisory scoped before the work starts, so you know what the engagement covers and what it costs before you commit to it.

Free Discovery
01

Scoping Call

Free 20 to 30 minute EU compliance consultation

Bring the specific compliance issue you are dealing with, whether it is a customer DPA you have been asked to sign, an app store submission that has been rejected, or uncertainty about your current GDPR and EU regulatory compliance. We will identify which EU laws and compliance requirements apply to your business, where your exposure sits, and what needs to be done to become compliant.

Within two working days, you will receive a written scope of work with a fixed fee.

The consultation covers
- Identification of applicable EU laws and compliance requirements
- Assessment of your regulatory and compliance exposure
- Written scope of work
- Fixed fee for the required work
GDPR · ePrivacy · DSA
02

Compliance Review

From €100 — fixed fee agreed at scoping

A review of what you publish and what you have committed to contractually, against every EU instrument that reaches your business. Scope runs from a single privacy policy up to a full review across GDPR, ePrivacy, the DSA, and EU consumer law.
- Privacy policy, cookie policy & consent banner review
- DPA & subprocessor list review
- DSA obligations (notice and action, transparency, contact points)
- Written report ordered by exposure
Code-Level Compliance
03

Technical Legal Audit

Scoped individually

This audit reads the codebase rather than the documentation. It establishes what the application collects, where it transmits, and what it retains, then measures that against what your privacy policy, your DPA and your app store declarations say it does. Where the two diverge, the published document is the one a regulator holds you to.
- SDK & third-party dependency inventory
- Outbound network call & data flow map
- Consent implementation traced against ePrivacy & Art. 7 GDPR
- Retention as implemented vs. retention as stated
- App Store & Play Store declarations verified against behaviour
- Discrepancy report with remediation
DPAs, Policies & Notices
04

Documentation Drafting

From €150 per document — quoted per engagement

Drafting for your actual processing rather than adaptation of a template. Commercial data processing agreements and negotiated data protection schedules are the bulk of this work, including marking up the DPA a customer or a vendor has put in front of you.
- DPAs & negotiated data protection schedules
- ROPA
- DPIA
- Privacy policy & cookie policy
- Article 50 AI transparency notice
- Subprocessor list
- Breach response plan
Regulation (EU) 2024/1689
05

AI Act Classification & Documentation

From €200 — scoped to the system

Classification under Regulation (EU) 2024/1689 and the documentation that follows from the classification. Most engagements conclude that a system carries transparency obligations alone, and that conclusion, put in writing with reasoning, is what you hand to a customer running vendor due diligence.
- Written classification with reasoning
- GPAI obligations for third-party foundation models
- Article 50 transparency notices & synthetic content marking
- Annex IV technical documentation for high-risk systems
- Training data governance documentation
- AI risk assessment
Article 37 GDPR — Retainer
06

Fractional DPO

From €200/month — minimum 6-month term

A named privacy lead on retainer appointed as your DPO under Article 37 GDPR where the appointment is mandatory.
- Named DPO appointment & supervisory authority notification
- Data subject contact point (Art. 38(4))
- DSAR triage & response
- Breach assessment & Art. 33 notification decisions (72hr window)
- And more

01 / 06

Service detail, turnaround and terms

Where we're brought in

The problems that start an engagement

A customer has sent you a DPA to sign

Enterprise procurement arrives with a data processing agreement, a security schedule and a subprocessor question you cannot answer from memory. We mark up what has been put in front of you and draft what is missing.

You are shipping an AI feature

Before the feature ships, someone needs to establish what Regulation (EU) 2024/1689 requires of it. Most systems carry transparency obligations alone — but that conclusion has to be written down, with reasoning, to be worth anything.

Your product reaches EU users without an EU entity

Territorial scope, EU representative requirements and transfer mechanisms apply to you whether or not you have an office in Europe. We establish where the exposure actually sits rather than applying the whole regime at once.

What you publish no longer matches what you built

Privacy policies, app store declarations and DPAs drift from the software as it changes. Where the two diverge, the published document is the one you are held to — so we read the codebase, not just the paperwork.

Selected engagements

Recent work

Client details are withheld. Each summary describes the regulatory question, the work carried out, and what the client was left holding.

US analytics SaaS

Territorial scope · customer due diligence

A product company with no European entity had begun closing EU customers, and security questionnaires were stalling deals. We established which processing activities fell within Article 3(2), reviewed the transfer position, and drafted the processing agreement and subprocessor list the buyers were asking for.

Outcome: a defensible written position on EU reach, and a documentation set the sales team could send without routing each request through counsel.

Consumer mobile application

ePrivacy · store declarations

A store submission was rejected over data-collection declarations that did not match the application's behaviour. We inventoried the third-party SDKs, mapped outbound calls against the published privacy policy, and traced the consent implementation against the ePrivacy Directive and Article 7 GDPR.

Outcome: a discrepancy report with remediation steps, corrected declarations, and a privacy policy describing what the application does.

B2B platform adding an AI feature

Regulation (EU) 2024/1689

A summarisation feature built on a third-party foundation model raised questions from the client's largest customer. We classified the system under the AI Act, set out the obligations attaching to use of a general-purpose model, and drafted the Article 50 transparency notice.

Outcome: a written classification with reasoning that satisfied vendor due diligence, and transparency wording shipped with the feature.

Resources

Guidance and training

Written guidance on the obligations that come up most often, and a structured data protection course for teams building the knowledge in-house.

Browse compliance guidance

Data protection training

GDPR for US SaaS Companies:The Complete 2026 Guide

A practical guide for US-based software companies navigating GDPR, the Swiss FADP, the EU AI Act, the Data Act, the Digital...

EU AI Act for SaaS Companies:What You Need to Do in 2026

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law. It entered into force...

Standard Contractual Clauses (SCCs) for SaaS CompaniesA Practical Guide to GDPR Cross-Border Data Transfersfor Cloud and Software-as-a-Service Providers

This guide explains Standard Contractual Clauses (SCCs) as they apply to SaaS businesses that transfer personal data outside...

Do I Need a GDPR EU Representative?A Practical Decision Guide for SaaS Companies

If your SaaS company is based outside the EU but has European users, you almost certainly need an EU representative under GDPR...

Start with a scoping call

Bring the specific problem. The call establishes which instruments reach your business and what the work involves; within two working days you receive a written scope with a fixed fee.

Send an enquiry