# GDPR Remediation Roadmap -- Nexus Technologies GmbH

**Created**: 2026-01-15
**Owner**: Dr. Katharina Weiss, DPO
**Programme Sponsor**: Jan Mueller, CTO

---

## Phase 1: Critical Remediation (Months 1-3)

| ID | Action | Gap Reference | Owner | Deadline | Budget |
|----|--------|--------------|-------|----------|--------|
| R-001 | Execute Art. 28(3) DPA addenda for 4 processors | GAP-C01 | Procurement | 2026-02-28 | EUR 5,000 (legal review) |
| R-002 | Complete DPIA for employee monitoring system | GAP-D01 | DPO Office | 2026-03-15 | Internal effort |
| R-003 | Complete DPIA for customer credit scoring | GAP-D02 | DPO Office | 2026-03-31 | Internal effort |
| R-004 | Integrate privacy review gates into SDLC | GAP-C02 | CTO Office | 2026-04-15 | EUR 15,000 |

## Phase 2: Major Remediation (Months 3-6)

| ID | Action | Gap Reference | Owner | Deadline | Budget |
|----|--------|--------------|-------|----------|--------|
| R-005 | Deploy automated retention enforcement | GAP-P01 | IT Operations | 2026-06-30 | EUR 25,000 |
| R-006 | Implement data portability API | GAP-R01 | Engineering | 2026-06-30 | EUR 20,000 |
| R-007 | Establish processor audit programme | GAP-C03 | DPO Office | 2026-05-31 | EUR 10,000 |
| R-008 | Update consent mechanisms for granularity | GAP-L01 | Marketing | 2026-05-15 | EUR 8,000 |

## Phase 3: Enhancement (Months 6-12)

| ID | Action | Owner | Deadline |
|----|--------|-------|----------|
| R-009 | Deploy privacy management platform | DPO Office | 2026-09-30 |
| R-010 | Implement automated DSAR workflow | IT / DPO | 2026-10-31 |
| R-011 | Pursue Europrivacy certification | DPO Office | 2026-12-31 |

## Total Programme Budget: EUR 120,000

**Approved by**: Board of Directors, 2026-01-20