The hinge of compliance.
Practical GDPR for RO/EU firms,
without big-firm costs
Audits, DPO support, data mapping and DSAR handling for companies that want order, lower risk and clear steps.
We work with firms between 10 and 200 employees in RO/EU.
The real problem
Compliance isn't hard because the law is technical — it gets hard when no one has the full picture.
Across small and mid-size companies, contracts, SaaS vendors, CRM data, CVs in email and backups quietly accumulate. Cardinem turns GDPR from an abstract list of obligations into an operating system: what data exists, who uses it, where the risks live and what to fix first.
How we work
Direct, pragmatic, cost-aware.
For most firms the problem isn't a missing document, it's the missing order between processes, responsibilities and evidence. We start with real context, separate signal from noise, produce useful artifacts (not decorative paperwork) and build recommendations for teams whose people already wear multiple hats.
We start with real context
We understand the business model, data, suppliers and commercial pressures before applying templates.
We separate real risk from noise
We prioritize impact: legal basis, transfers, access, processes, DSAR, documentation.
We produce useful evidence
Registers, data maps, recommendations, short procedures, remediation plans — usable, not decorative.
We build for lean teams
Compliance must reduce uncertainty, not become another heavy system to maintain.
Services
Five dedicated services
GDPR Audit
Where you stand, what's missing, what to prioritize.
→
DPO Services
External DPO or recurring privacy guidance.
→
Data Mapping
Data flows, systems, roles, suppliers, risk points.
→
DSAR Handling
Access, deletion, rectification, objection requests.
→
About Cardinem
Who we are, how we work, why founder-led.
→
About the founder
Founder-led.
You work directly with the person reviewing the facts, shaping the recommendations and taking responsibility for the quality of the work. The approach is practical, careful and intentionally lean, without big-firm structure or cost added for appearances. Additional professional credentials are planned, including the CIPP/E path, but we don't claim certifications we don't yet hold.
Need a clear view of your GDPR position without turning it into an oversized project?