I have worked with security more or less since 1992. First as CIO, then security manager, but since Sept 2000 as consultant. I hold CISA, CRISC and CDPSE, but my strength is having dealt with all parts of information security management, business continuity management, data protection and privacy, document retention and security risk management to name few in my work. I have also been lecturing on these issues as well as being the instructor for Icelandic Standard introductory workshops on the ISO 2700x standards since 2006 and ISO 27701 since 2020. I have taken two of my clients through ISO 27001 certification, both on first try. On Sept 1, 2012 I joined HP Denmark as Senior Security Consultant. Since then I have been in the role of Client Security Officer, Account Delivery Manager for security, T&T security consultant and general security consultant on various accounts and for the past few years Lead Security Consultant. From September 1, 2012 to October 31, 2015 as part of HP Denmark, from November 1, 2015 to December 31, 2016 as part of Hewlett-Packard Enterprise Denmark, from January 1 to March 31, 2017 as part of Enterprise Services Denmark, and from April 1, 2017 as part of DXC Technology/DXC Security. (This is all the same consulting position, only the name changed do to splitting and merging.) Left DXC in January 2023.In 2017 I was asked by Icelandic Association of Local Authorities to assist all primary schools and later all kindergartens in Iceland to prepare for GDPR. For that I created a simple, self paced framework for the schools to follow including information security and privacy risk assessment, policy statement, policies, regulations and key processes/procedures. The project was later reviewed and approved by The Icelandic Data Protection Authority. Specialties: Consulting on information security management system (ISO 27001/27002), risk management (ISO31000/ISO 27005), data protection and privacy (GDPR EU 679/2016, ISO 27701 and before EU directive 95/46/EC), and information security audit. My strength is having had to deal with various challenges each requiring expert knowledge. In recent years GDPR has been the hottest topic. GDPR is like Latin to many as they lack the connection to ISO 27001/27002 and ISO 27701. Combined ISMS/PIMS based on these standards is what I recommend and have already taken a start up through such certification. NIS2 and DORA can be implemented with not so complicated additions to ISMS based on ISO 27001.