Privacy and GRC Advisory
If you have a privacy notice, an appointed owner and no way to show a customer or a regulator what is actually true, this is for you. We establish your position against the regime that applies to you, record the evidence behind every obligation, and leave you a register your own team maintains.
You have a privacy notice, somebody named as the owner, and a policy in a folder. Then a customer sends a questionnaire, or a subject makes a request, or something is lost, and every question is operational: where is the data, who can reach it, how long do we keep it, and can you show me.
Your team probably knows most of the answers. What is missing is the evidence that they are true, held where a third party can read it, and a way to keep it current without the work starting over every year.
Which obligations are yours, decided against your processing rather than a template, and recorded with the reason.
Obligations that do not apply are written down as not applicable with the basis for it. A register that silently omits one cannot be defended later, and the omission is always found by somebody else.
Each requirement assessed against an artifact and a population, not against a policy statement.
Met, met but not evidenced, and not met are three different findings. The middle group is usually the largest and the cheapest to close, and it is the one a red amber green exercise cannot tell you about.
A subject access request and a breach notification both run on a deadline, and both fail in the same place.
We follow each path end to end through your own published channel, because the written procedure is never the part that breaks. The question is who receives it, who owns it, and whether anybody is watching the clock.
What your systems actually delete, against what your policy says they do.
A policy stating seven years and a system with no deletion job are two different facts, and only one of them is true. This is the most common gap and the one most often reported as closed.
Every flow leaving your jurisdiction or reaching a third party, with the agreement or the condition that permits it.
Where there is no agreement, that absence is the finding, and it is usually contractual rather than technical, which means it goes to a different team than people expect.
The deliverable that outlives the engagement. Every obligation, its state, what was examined and when.
Built so your own people update it, with the method handed over. The next cycle measures change rather than repeating the purchase.
Most privacy reviews end in a judgement. Somebody experienced looked, and this is what they think. That is worth something, and it is unfalsifiable: a year later nobody can tell whether a conclusion came from evidence or from an afternoon.
Every conclusion here is a working paper. What was examined, across what population, what limitation applies, and what that supports. A complete population where the scale allows, a stated sample and its basis where it does not. It is the artifact your own auditor reads, the thing a customer can test, and the reason an interview never settles an obligation on its own.
It is also why your administrators run every extract and we hold no credential into your environment. The evidence is yours, it never leaves your control, and the work can be repeated by somebody who is not us.
Client and parent company renewals increasingly turn on a data protection answer. Answering well keeps that conversation about price.
Knowing what was held, and whose it was, decides notification. That decision does not wait for an investigation.
An unanswerable question becomes a scramble across departments. A register turns it into a lookup, and the executive team stays on the business.
The register and the method are yours, so the next cycle measures change rather than rebuilding the position from nothing.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
Whichever applies to you. The method does not change between them: establish what applies, assess each obligation against evidence, record what was examined. Jamaica's Data Protection Act, UK and EU GDPR and equivalent regimes all resolve to a set of assessable obligations, and where you carry more than one we map the overlap rather than pretending one covers the other.
It is the part everybody does, and it is not where the exposure is. A notice describes an intention. The questions a customer or a regulator asks are operational, and they are answered with records rather than with documents.
A gap analysis marks obligations red, amber or green, usually from a workshop. Here every conclusion records what was examined, across what population, so somebody outside your organization can check it. That difference is the entire point, and it is what survives being questioned.
No. Your own administrators run any extract and you see the output before it leaves your network. We hold no credential into your environment, and that is a property of how we work rather than a concession.
Certify you, because no regime certifies data protection compliance and anybody offering a certificate is selling something that does not exist. Give legal advice, or act as your data protection officer, since that role requires independent monitoring of the controller. Or test your systems, which is a control assessment and a separate engagement.
Which obligations are yours is answerable in a conversation, before anybody is engaged. Organizations regularly find they need less than they feared, or that the one thing they skipped is the one carrying a deadline.
Related services: Data Protection Impact Assessment · Third-Party Security Reviews