Part of what a contracting authority or insurance company asks for, you can prepare yourself: an overview of which personal data you process, which tools you use for that and which agreements you have with suppliers. What is harder to do yourself is keeping the overview complete and current, and substantiating that the measures taken are genuinely appropriate for what you process. The latter requires structure that evolves over time, not a snapshot.
Whether doing it yourself suffices depends heavily on what exactly is being asked. An insurance company sending a questionnaire about basic security measures is different from a contracting authority wanting to see a complete processing register, processor agreements and a DPIA (data protection impact assessment). The broader the request, the more work it costs to get that in order and keep it that way.
What a contracting authority or insurance company is actually asking for
The question "demonstrate that you comply with the GDPR" rarely exists in practice in those exact words. Usually you are asked for concrete documents: a processing register, evidence of processor agreements with suppliers, a description of technical and organisational measures, and sometimes a statement on how data breaches are handled. The GDPR itself requires organisations to be able to account for the processing they carry out; what an individual contracting authority or insurance company asks on top of that is their own, additional requirement that can differ per party.
It is therefore important to first get clear on what exactly is being asked, before you decide how much work it is to handle it yourself. A short questionnaire can be answered with an afternoon's research; a full audit requires documentation maintained structurally.
What you can prepare yourself
An initial inventory is something most entrepreneurs can do themselves: which SaaS tools do you use, which of those process personal data, and do you have a processor agreement from each supplier. A general description of security measures — password policy, who has access to which systems, whether there are backups — can be drawn up with common sense without external help. the knowledge base with explanations by topic provides a brief answer per situation and the reference in the official text, so you know where a requirement comes from before you start work on it.
Anyone in doubt whether a reported data breach should have been reported in the past can check that themselves: see in a few questions roughly where you stand provides an initial indication, regardless of whether that specific case should or should not have been reported at the time.
Where doing it yourself becomes more difficult
The complexity usually lies not in one document, but in the coherence and currency of the documents. A processing register drawn up a year ago and not updated since is already out of date with a new SaaS tool or a changed supplier. Processor agreements you signed once need to match what you now actually do with that supplier. And an insurance company or contracting authority often does not just ask for the existence of documents, but for a consistent narrative: register, agreements and measures that logically align with each other.
That maintenance is precisely where keeping things up to date yourself will cost many SMEs time they do not have. A system that fills the register from a library of known tools and monitors whether processor agreements still match removes that maintenance from your hands without you having to become a lawyer yourself.
What remains, even if you tackle it yourself
No tool can take over your final assessment: you decide what you disclose to a client or insurer and whether that meets their requirements. Structure and guidance can significantly lighten the work, though. the page where the information comes from explains how gdpria.eu bases its content on the GDPR itself and on guidelines from the EDPB and the Dutch Data Protection Authority, including the source reference, so you don't have to take our word for it but can review the source yourself.
The boundary in practice
As a rule of thumb: a one-time, limited question is often something you can answer yourself with a day of research. Once you have an ongoing register, multiple vendors with changing data processing agreements, or recurring requests from multiple clients, maintenance becomes the bottleneck, not the initial setup. At that point, outsourcing to a system or advisor is often less a luxury and more a way to reclaim time.
Are you curious what that would save you in your situation? Take the free quick scan or browse the frequently asked questions on this subject to see which step makes the most sense for you.