One workflow first. The map after.

A written report on one workflow, and a sixty-minute readout. The report covers how the workflow runs today, where people intervene and with what authority, where work passes from one person or system to another, and the points where what you describe and the available elements disagree. It closes with what must be decided: each open question, the person observed to hold the authority to settle it, and a deadline only where a dated fact of yours carries one. What the report does not contain: no action plan, no thirty, sixty or ninety-day roadmap, and no owner appointed by us. A holder appears only where one is observable, a deadline only where one of your own dated facts carries it. What to do next is yours to decide.

Five business days from the close of collection. Collection closes once your elements are in, which means you can lengthen your own timeline by taking longer to provide them. From your side, three hours thirty in total: ten minutes of questionnaire, two hours thirty of conversation — a short scoping call, a second conversation once we have read your elements, and the readout — and thirty minutes gathering elements. We ask for three to five pieces you already hold, never anything you would have to produce. We do not interview your teams at this stage. We also ask for whatever material already exists: an export, a shared calendar, a version history, a folder of dated files. We ask for exports rather than access, which keeps the effort light on your side. Where nothing is available to check a point against, we present it as an open question rather than a conclusion.

Neither. An audit checks compliance against a standard and issues a judgement. This is an analysis of how one workflow actually runs, on a given date, where each finding states what it rests on. Nothing is certified and no grade is given. Sprinkling Act is not a law firm, not a Notified Body and not a certification body. Where a regulatory reading is relevant to your situation, it is added as an annotation on top of the analysis, and it does not replace qualified counsel.

Their reporting is a necessary input and we start from it. Your provider knows their tool better than anyone, and your teams know their own work. What is missing is that nobody’s role is to bring the two together across the whole workflow. That is the work we do, so everyone is looking at the same picture when the decision comes up.

You can, and some organisations do. What makes it harder than it looks is not effort, it is position. A director describing their own organisation is describing what reached them, and the survey exists to measure how far that is from what the elements show. Doing it yourself means being both the source and the person checking the source, which is the one thing the exercise cannot afford. The second obstacle is duller: the work takes days that get postponed by whatever is urgent that week. Doing it in-house afterwards is easier once a first picture exists.

Because another text already applies to the same facts, and has done since 2018. Regulation (EU) 2016/679 requires a contract with any processor acting on your behalf (article 28), a record of processing activities (article 30), and appropriate technical and organisational measures (article 32). An AI tool a team brought in without going through you may fall under all three without anyone having checked. That lever is already applicable, already familiar to your advisers, and already enforced. What the Baseline does with that, and what it does not: it does not produce your record. The record is your obligation, its completeness is your liability, and a partial record drawn up by a third party would expose you more than an acknowledged gap. What it does is document a chain your record probably ignores, and put you in a position to know what is missing from it. It reveals part of the obligation; it does not discharge it. To be clear on what we are not: this is not a GDPR compliance exercise, not a data protection audit, we do not act as your data protection officer, and the legal qualification of a processing operation is your counsel's call, not ours.

The price is a fixed fee, agreed before the work starts, and it does not move afterwards. Two things drive how much a survey actually takes: the number of categories of elements you can provide, and the number of tools that appear in your invoicing without appearing in what you described to us. Neither of us knows those at signature — establishing them is part of what the survey is for. The fixed fee puts that risk on our side: if the dossier turns out three times heavier than expected, you pay the same. A dense dossier costs no more, and a simple one buys the same conclusion. Sprinkling Act is a Belgian entity, BCE and VAT number BE 1034.962.482. Prices are shown excluding VAT. Belgian clients are charged Belgian VAT at 21%. EU B2B clients with a valid VAT number are invoiced under the reverse charge. Clients established outside the EU are not charged Belgian VAT.