Every day, a consulting firm handles data that does not belong to it: the HR files of a client going through a restructuring, the prices and margins of a panel of companies, a subsidiary's customer data, an executive team's strategic plans. Some of it is personal data, some of it is trade secrets. All of it engages the firm's liability.
GDPR compliance for a consulting firm rests on three pillars: a clear legal framework (who does what, contracts, non-disclosure agreements), serious technical measures, and disciplined use, especially of AI tools, which turn every deliverable into a potential leak.
This guide covers the consultant's role under the GDPR, the data processing agreement, non-disclosure agreements, protecting industry benchmarks, using AI on deliverables, everyday security, managing your own subcontractors and what to do if there is an incident.
The golden rule: client data never leaves your perimeter in identifiable form. Not to an AI tool, not to a partner, not in a published benchmark.
Key takeaways
| Point | Details |
|---|---|
| Define your role | Processor or controller: everything follows from that, including your liability. |
| The article 28 contract is mandatory | As soon as you process personal data on behalf of a client. |
| Trade secrets fall outside the GDPR | They need a precise non-disclosure agreement, on top of the GDPR contract. |
| A benchmark can give away its participants | Small samples and geographic detail let people recognize a company. |
| AI is the new leak point | Pseudonymize deliverables before sending them to any outside tool. |
Table of contents
- The seven pillars of a firm's compliance
- Controller or processor?
- The data processing agreement (article 28)
- Non-disclosure agreements and trade secrets
- Protecting industry benchmarks
- AI on client deliverables
- Everyday security
- Choosing and monitoring your own subcontractors
- If there is a data breach
- The DPO and staff training
- Turning confidentiality into a selling point
- The most common mistakes
- Safe-doc for consulting firms
- Frequently asked questions
- Further reading
- Sources
- Recommended reading
The seven pillars of a firm's compliance
| Pillar | Concrete action | Priority |
|---|---|---|
| Records of processing | List purposes, categories of data, recipients and retention periods, including processing carried out on behalf of clients | Immediate |
| Informing individuals | Privacy notices for your own clients, staff and candidates | Immediate |
| Legal bases | Define the basis for each processing operation: contract, legal obligation, legitimate interest | High |
| Data processing agreements | An article 28 contract with every client whose data you process, and with each of your own providers | High |
| Security | Strong authentication, encryption, backups, updates | High |
| Individual rights | A procedure for answering access or erasure requests within one month | Medium |
| Incident management | A procedure for detection, notification and documentation | Mandatory |
Your records must separate two categories: processing for which you are the controller (your clients, your staff, your business development) and processing you carry out on behalf of clients. Article 30(2) of the GDPR requires processors to keep that second record.
Controller or processor?
The answer does not depend on what the contract says, but on what actually happens: who decides the purposes and the essential means of the processing?
If the client decides why and how its data is processed, and you act on its instructions, you are a processor. If you decide the purpose or the essential means yourself (for example, by reusing data from an engagement to build a benchmark that you sell), you become a controller, or even a joint controller with your client.
And if you in turn hand part of the work to a provider (a freelancer, an online tool, an AI vendor), that provider becomes a subprocessor: you need the client's authorization.
In consulting, the line shifts easily. Record the role you take on for each engagement in your records.
What the GDPR requires of a processor
A processor only processes data on the client's documented instructions, and guarantees its confidentiality, including toward its own staff. It implements security measures suited to the risk (article 32), and helps the client answer individuals' requests and carry out its impact assessments.
It notifies the client of any data breach without delay, and returns or destroys the data at the end of the engagement. It only uses a subprocessor with the client's authorization, passing on the same obligations.
The data processing agreement (article 28)
A valid data processing agreement is not a generic form. Article 28(3) of the GDPR requires it to set out the subject matter, duration, nature and purpose of the processing, the type of data and categories of people concerned, and the controller's obligations and rights.
| Article 28(3) requirement | Practical contract clause |
|---|---|
| Processing on instructions only | Documented instructions clause and change procedure |
| Staff confidentiality | Confidentiality undertaking signed by each authorized person |
| Security measures | Technical annex listing the measures in place |
| Subprocessing | Prior authorization (list or approval) and flow-down of obligations |
| Assistance with individual rights | Deadlines and assistance procedure |
| Breach notification | Notification deadline to the controller, often set between 24 and 48 hours |
| Audit | Client's audit right, notice period and scope |
| End of contract | Deadline, return format and proof of destruction |
| Transfers outside the EU | Applicable mechanism: adequacy decision, standard contractual clauses |
Describe the categories of data precisely. "HR data" is too vague: write "name, employee ID, pay, annual reviews". A vague list weakens the contract in a dispute.
Non-disclosure agreements and trade secrets
The GDPR only protects personal data. Your clients' prices, margins, strategic plans, know-how and projects fall under trade secret protection (in the EU, the 2016 Trade Secrets Directive, transposed in France in articles L151-1 and following of the Commercial Code), which requires, among other things, that the holder has taken reasonable steps to protect them. A non-disclosure agreement is one of those steps. In M&A, these documents go through a GDPR-compliant data room.
A vague non-disclosure agreement protects poorly. To make it effective, start by defining its scope precisely: financial data, strategic plans, clients' personal data, source code, and so on. An annex lists the categories of data, the formats covered (files, paper, verbal exchanges) and the systems.
Include proportionate penalties, deterrent but defensible, and set out what happens to the information at the end of the engagement: return, certified destruction or secure archiving, with deadlines. And review the agreement at each engagement renewal or change of scope.
Have your non-disclosure agreements reviewed by a lawyer before signing. A well-drafted clause in the main contract protects better than an overly generic separate agreement.
Protecting industry benchmarks
An industry benchmark is never just a table of neutral figures. It aggregates the prices, margins, volumes or practices of several companies, and each of them may try to recognize itself, or its competitors. For a published benchmark, anonymization is often preferable: see pseudonymization vs anonymization.
Classify the variables
First, list every variable in the benchmark: price, margin, volume, customer segment, geographic area. For each one, assess the impact of disclosure (low, medium or high), and cross it with the number of people or third parties who will have access to the file. That gives you a risk level and a protective measure for each variable, a table the DPO and the legal department sign off on before anything is shared.
Reclassify every time the scope changes. A figure aggregated across five companies changes status if the panel drops to three.
Test re-identification before release
A benchmark can follow every rule and still be re-identifiable. Before releasing it, imagine a realistic adversary: a competitor, a journalist, a participant trying to recognize the others. Check how many entities share the same visible characteristics (the principle of k-anonymity), and that the sensitive values really vary within each group (the principle of l-diversity). Then simulate a cross-match with the industry's public data.
| Situation observed | Corrective measure |
|---|---|
| Fewer than 5 entities share the same characteristics | Aggregate further before publishing |
| A group is uniform on a sensitive variable | Introduce controlled variation in the values |
| Geographic granularity too fine | Move up to regional level |
| Fewer than ten entities in a segment | Suspend external release of that segment |
These thresholds are common benchmarks, to be adapted to the industry and the sensitivity of the data. Document each test in a report.
Lock down sharing
In the contract, the non-disclosure agreement must explicitly cover the benchmark data and prohibit its reuse for another client or project. It provides for its return or destruction with proof, an audit right over the promised security measures, and specifies where processing takes place.
If the benchmark processes a significant volume of personal data or sensitive data, an impact assessment becomes necessary.
AI on client deliverables
The riskiest moment of an engagement is often when a consultant, to save time, pastes a client report, a benchmark file or a strategy memo into an AI assistant. Depending on the tool and the plan, that content may be retained, or even reused. For these everyday uses, the Safe-Doc Chrome extension pseudonymizes right in ChatGPT or Claude.
Before sending, pseudonymize the names of clients and their employees, company names, identifying amounts and places, and keep the mapping table at the firm, never at the AI provider. Use only tools covered by a contract (no training, deletion, location), and tell the client which tools you use and which safeguards apply.
Pro tip: A pseudonymized deliverable stays usable by the AI if the aliases are consistent (CLIENT_A, SUBSIDIARY_2, COMPETITOR_3). Replace with aliases, not blanks.
For the detailed method on documents: Pseudonymizing PDF contracts.
Everyday security
| Measure | Purpose | Evidence for an audit |
|---|---|---|
| Multi-factor authentication | Protect email, storage, collaboration tools | Account configuration |
| Encrypted devices and exchanges | Protect data if a device is lost or traffic intercepted | Configuration, written policy |
| Password manager | Eliminate reused passwords | Policy and deployed tool |
| Systematic updates | Fix known vulnerabilities | Patch history |
| Pseudonymization | Reduce the risk if there is a leak, and before AI | Processing reports |
| Least-privilege access | Each consultant only accesses their own engagements | Rights matrix, logs |
| Backups with an offline copy | Withstand ransomware | Restore reports |
| Logging | Detect and prove | Timestamped logs |
| Phishing awareness | Reduce human error | Training certificates |
Stop sending sensitive documents by ordinary email, even password-protected: prefer a secure exchange space or expiring links. For sensitive data, choose solutions hosted in the European Union.
Choosing and monitoring your own subcontractors
Freelancers, online tools, AI vendors, hosting providers: each of your providers that touches a client's data is a subprocessor.
Before signing
Before signing, ask the provider for its security policy and business continuity plan, along with the list of its own subprocessors and their locations. Check its certifications (ISO 27001, ISO 27701, SOC 2): their date, their real scope and the body that issued them. Review its data processing agreement against article 28, and record the outcome in your records.
Pro tip: A certification is a signal, not proof. Also ask for recent operational evidence: dated penetration test reports, architecture documentation, incident procedure.
During the contract
During the contract, plan an annual or on-demand audit, carried out directly or by an appointed third party, and track a few security indicators, such as incident notification time or backup frequency. The contract is updated after every significant change.
| Subprocessor register item | Content |
|---|---|
| Identification | Company name, address, DPO contact |
| Purpose | Data processed and use |
| Location | Hosting country, any transfers |
| Security | Encryption, certifications, access policy |
| Contract | Reference, signing and review dates |
If there is a data breach
Responsibility is shared, but not symmetrical. The processor alerts the controller without delay, within the deadline set in the contract. The controller notifies the supervisory authority within 72 hours if the breach poses a risk to individuals (article 33). And the people concerned are informed if that risk is high (article 34). Real cases are analyzed in 8 examples of HR data breaches.
The 72-hour clock starts when you become aware of the breach, not when it is resolved. Hesitating to notify usually costs more than notifying.
To prepare before any incident: an incident log (even for minor ones), a lead responsible for assessing incidents, a notification template, and a procedure for documenting afterwards.
The DPO and staff training
Appointing a data protection officer is mandatory in certain cases (GDPR article 37), notably when the core activity involves regular and systematic monitoring on a large scale or large-scale processing of sensitive data. Even when it is not mandatory, a named lead is useful. A shared external DPO gives mid-sized firms access to expertise without a full-time hire. The checkpoints a DPO needs are gathered on the Safe-Doc for DPOs page.
A well-written policy is worthless if consultants do not know it. Training starts with general awareness (phishing, passwords, attachments), then adapts to each role: consultants, assistants and sales teams are not exposed in the same way. A digital charter signed on arrival, a list of approved tools and a clear incident reporting procedure complete the setup, with content updated every year.
Since February 2025, article 4 of the EU AI Act also requires companies that use AI systems to ensure a sufficient level of AI literacy among their staff.
Turning confidentiality into a selling point
For a consulting firm, data protection is also a sign of seriousness to legal departments and large accounts.
A few simple steps make it visible. A compliance questionnaire at the start of the engagement shows the subject is taken seriously, and a one- or two-page note describing the measures applied to the engagement reassures decision-makers. Clauses tailored to each client show your maturity.
Large accounts also appreciate the list of tools you use, with their hosting guarantees. And a "data security" section in your proposals sets you apart from competitors who never mention it.
Getting outside help
If you call on a firm that specializes in the GDPR, check its references in your industry, its ability to provide an external DPO, its tools (records, up-to-date templates), the clarity of its fees, and that it signs a data processing agreement with you itself. For a law firm, command of the profession's ethics rules is essential.
The most common mistakes
The first mistake is not defining your role, only to discover during an incident that you were the controller. The second is reusing data from one engagement for another client or a benchmark, with no legal basis or agreement. Other common ones: client deliverables sent in clear text to a consumer AI, and releasing a benchmark built on too small a sample.
The last ones concern contracts and tools: signing generic non-disclosure agreements, forgetting your own providers (freelancers, online tools) in the subprocessing chain, and sending sensitive documents by ordinary email.
Safe-doc for consulting firms
A consulting firm does not need a new platform to protect its engagements. Safe-doc sits in front of the AI tool your consultants already use: deliverables, benchmarks and meeting notes (PDF, Word, spreadsheets) are pseudonymized, and the client names come back in the answer.
Nothing is hosted at Safe-doc after processing, which simplifies your answers to large accounts' security questionnaires. Teams that automate their analyses call the same pseudonymization through the API, or from an agent through the MCP server. See the page for consulting firms.
Frequently asked questions
Is a consulting firm a controller or a processor?
It depends on each engagement. If you process the data on the client's instructions, you are a processor. If you decide the purpose or the essential means yourself, you are a controller.
Is an article 28 contract mandatory for a consulting engagement?
Yes, as soon as you process personal data on behalf of a client. It must include the terms required by article 28(3) of the GDPR.
Does the GDPR protect my clients' trade secrets?
No. It only protects personal data. Strategic information falls under trade secret protection and must be covered by a non-disclosure agreement.
How do you anonymize an industry benchmark?
By aggregating enough entities per segment, reducing geographic precision, checking that sensitive values vary within each group, and testing re-identification before release.
Can you use ChatGPT or Claude on a client deliverable?
Yes, if the deliverable is pseudonymized before sending, the tool is covered by a suitable contract and the client is informed.
How quickly must a breach be notified?
The processor alerts the client without delay; the controller notifies the supervisory authority within 72 hours if the breach poses a risk to individuals.
Further reading
- Data rooms and the GDPR: the evidence to require before due diligence
- Pseudonymizing employee files: the complete guide for HR
- Contracts with AI vendors: the clauses to require (GDPR, AI Act)
Sources
- GDPR: official text (EUR-Lex)
- CNIL: personal data security guide, 2024 edition (in French)
- CNIL: anonymizing personal data (in French)
- MEDEF: guide on sensitive data (in French)
- Cigref: protecting sensitive non-personal data (in French)
This article is general information and does not replace advice from a qualified lawyer. Consult a legal professional about your situation before acting on this content.