No public evidenceKivu Consulting and GDPR
CertReports found no public GDPR evidence for Kivu Consulting as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 18 Jun 2018
- Scope
- Kivu is in the business of investigating cyber attacks carried out against Kivu's corporate clients in the US and EU. In the course of investigating cyber attacks against corporate clients in the EU, Kivu may take possession of computer devices and/ or digital data which may contain personal data of EU consumers. Kivu does not specifically collect EU consumer personal data - any such collection is incidental to its obtaining the necessary digital evidence to investigate possible cyber attacks in the EU. When carrying out such an investigation, Kivu is typically analyzing data (such as logs) which are automatically generated by computer systems. However, in collecting such evidence, Kivu may also take possession of EU consumer personal data that was also stored on the collected computers. Whether personal data is stored on the collected computers (and the nature of such personal data) will depend on the EU client. This could include names and identifiers of customers of Kivu's EU client; encypted or unencrypted passwords of customers of Kivu's EU private client; and human resource data related to the employees of Kivu's EU client. Kivu does not process the actual personal data found on collected computers/digital evidence, or use it for any business purpose other than incidental to Kivu's investigation of potential hacking and potential theft of that personal data. Kivu's investigation will determine whether, following a cyber incident, the relevant EU customer data may have been stolen/compromised thus requiring notification under GDPR. At all times the digital evidence collected from Kivu's EU client (that may potentially contain EU consumer personal data) is stored in an encrypted format under strict security. At the end of the investigation (or as soon as possible if regulatory proceedings have been initiated), Kivu securely deletes all digital data that may contain EU consumer personal data. In all assignments, Kivu is bound by strict contractual obligations of confidentiality and undertakes not to use or review any digital data collected in an investigation other than for the immediate goals of the investigation. Kivu is not otherwise in the business of collecting, storing or processing EU consumer data. Kivu will only disclose its findings (including potentially EU consumer personal data) to Kivu's EU client (that was storing the personal data) and/or the legal counsel for Kivu's EU client. The purpose of such disclosure is to allow Kivu's EU client to comply with the notification requirements of GDPR or other legal obligations.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Kivu Consulting, Inc.: Inactive | Live pagesha256 22a7072527 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Kivu Consulting GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags) whose GDPR row is verified or vendor-stated, ranked by similarity.
No same-category vendor has GDPR evidence in the index yet.