GDPR compliance

Yes. Neither the GDPR nor the Danish Data Protection Act distinguishes by size. If you have staff and customers, you process personal data. The exemption from keeping records for organisations under 250 employees is narrow and disappears as soon as processing is regular, which payroll always is. A small company has less to map, but the same kinds of documents.

Not automatically. If the provider is certified under the EU-U.S. Data Privacy Framework, or you rely on the EU standard contractual clauses together with a transfer assessment, the transfer can be lawful. It simply has to be documented. If you would rather avoid the question entirely, we can move the system to EU hosting, as described under our EU data residency solution.

For a formal review it might be. Paper does not protect data, though. The GDPR demands appropriate technical and organisational measures, and the regulator checks whether what is described has actually been done. We clearly separate what exists for the supervisory authority from what genuinely lowers the chance of a leak. You set the priorities.

With two weeks or more we can normally deliver both the documentation and the basic technical measures. If the deadline is tighter we will say so honestly and put first whatever the authority is asking about. You write the reply yourselves, while we supply the factual material about your systems.

At least yearly, and whenever you adopt a new system or supplier. Documentation that falls behind is almost as weak as none. Upkeep can be part of a managed IT agreement with us, so the annual cycle does not hinge on one busy colleague.