Compliance readiness
A technical gap assessment against the data protection, security and AI rules that apply to you — GDPR, NIS2, DORA, the UAE and Saudi PDPL and the EU AI Act — with the legal questions covered together with a legal partner.
Which rules, and what we look at
GDPR and UK GDPR
Personal data of people in the EU and the UK.
NIS2
Cybersecurity duties for organisations in the sectors it covers in the EU, and expectations it places on their suppliers.
DORA
Digital operational resilience for EU financial entities and their ICT providers.
UAE PDPL
Personal data processed in the UAE, with the DIFC and ADGM data protection laws where they apply instead.
Saudi PDPL
Personal data processed in Saudi Arabia, including data about its residents processed abroad.
EU AI Act
Duties for providers and users of AI systems in the EU, phased in over several years.
The technical side of each rule
Which of these matter depends on the rules in scope. We map every finding to the rule it belongs to, so nothing is assessed against one regulation in isolation.
- Where personal data lives, how it flows and who can reach it
- Access control, logging and how incidents are detected and reported
- Third-party and supplier risk, including cloud and SaaS providers
- Data transfers between countries
- Backups, continuity and recovery
- Where and how AI is used, and what data it sees
Scope, assess, report, roadmap
Scope
We confirm which rules apply to you, together with our legal partner.
Assess
We review systems, data flows and controls against each rule in scope.
Report
A gap register mapped to each rule, with evidence and a fix for each gap.
Roadmap
A prioritised plan, walked through with your team.
What you get
- A gap register, mapped to each regulation in scope
- A prioritised remediation roadmap
- A list of the evidence you already have and what is missing
- A short summary for leadership
Not included
- Legal advice or legal opinions
- Certification, audit or regulator sign-off
- Fixing the gaps, unless agreed as a separate engagement
Duration
Agreed at scoping, based on the rules in scope and the size of your systems.
Price
On request. Fixed and agreed in writing before work starts.
Is this the right fit?
Businesses selling into the EU, the UK, the UAE or Saudi Arabia that need to know where they stand, companies preparing for a customer or partner security review, and teams starting to use AI with personal data. For ongoing work, see Cybersecurity & compliance.
Common questions about the compliance readiness
Which regulations apply to us?
It depends on where you operate, who your customers are, your sector and how you use data and AI. We confirm which rules apply at scoping, together with our legal partner, before the assessment starts.
Is this legal advice?
No. Kashfora assesses the technical side: systems, data flows and controls. The legal questions are covered together with our legal partner where your engagement includes them.
Will we be certified or compliant at the end?
No assessment can promise that. You get a clear list of gaps and a plan to close them. Certification and audits are carried out by accredited bodies.
What do you need from us?
Access to the people who run your systems and data, existing policies and records, and read-only access to the systems in scope.
Can you help close the gaps?
Yes, as a separate engagement scoped after the assessment, or your team can work from the roadmap.
Find out where you stand
Tell us where you operate and what data you handle. We’ll tell you which rules are likely to matter and where to start.