Privacy and GRC Advisory
Some regimes ask for an assessment per project. Others, Jamaica's among them, ask for an annual one covering everything you hold. We build yours from your processing record, rate what risk each activity leaves after your controls, and write it so the accountable person can defend every line of it a year later.
An assessment gets done because somebody asked for one. A template is filled in after the decision was made, the risks are rated high, medium and low by whoever held the pen, and it goes in a folder.
A year later a question arrives about a decision it covered, and nobody can say what the rating was based on, what was considered, or who accepted the risk that remained.
Whether the obligation is annual and organization wide or triggered by a project, and which activities fall inside it.
Where it is organization wide, the assessment is only as complete as the processing record it starts from. Activities missing from the record are missing from the assessment, which is how a return ends up describing an organization that does not exist.
Fields collected against fields consumed. Retention claimed against retention configured. Recipients listed against recipients who actually receive.
This is the question that most often changes a design, and the one templates skip fastest.
Risk to the data subject and risk to the organization point in different directions often enough that conflating them is how an assessment passes something it should have stopped.
Each risk is rated against a scale written down and attached to the document, so a reader can re-derive a rating rather than take it on trust.
Every measure recorded with the risk it reduces and the risk it leaves behind.
A measure with no stated residual is an assertion, and it is recorded as one rather than counted as a mitigation.
Where a residual risk is accepted, by whom and on what basis.
An unnamed acceptance is not an acceptance. It is the absence of a decision, and it looks exactly like one until somebody asks.
Who was consulted, what they said, and what changed as a result.
Where a data protection officer or anybody else disagreed with an outcome, that is recorded rather than resolved quietly. An assessment showing only agreement tells a reader nothing about how the decision was made.
The value of an assessment is not that it exists. It is that somebody can follow the reasoning a year on, when the question is no longer hypothetical.
So the scale travels with the document, every residual is stated rather than implied, every acceptance carries a name, and disagreement is on the page. None of that costs more to produce. It costs something to leave out, and the bill arrives later.
Where the obligation recurs annually, the assessment is structured so the next cycle updates it rather than repeats it. The first year carries the cost. The years after should not.
What was considered, what was accepted, by whom and when. That is the difference between a judgement and an oversight when somebody asks later.
Necessity and proportionality are answerable at design and expensive after launch. One catch pays for the cycle.
Where the obligation recurs, holding current analysis turns a return into a presentation rather than a project competing for the same advisers as everybody else.
Which is the point, and it is also what a regulator, a customer and a claimant are each measuring you against.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
Either, and which one you need depends on your regime. Some ask for an assessment when processing is likely to be high risk. Jamaica's Data Protection Act asks for one covering all personal data in your custody, submitted annually in the form the Commissioner prescribes. The analysis is the same work; the packaging differs.
Because the analysis is the part that takes time and the form is the part that does not. The Commissioner has advised controllers to keep analysing and revising their processing in the meantime, and when a form is prescribed every controller has the same deadline and is looking for the same advisers.
For an assessment covering everything you hold, yes. We will not assess an inventory assembled from memory and describe it as comprehensive. If you do not have a record, that is prerequisite work and we quote it separately rather than hiding it inside this.
Your accountable person accepts the residual risk. We present each one with what it means before anybody signs, so nobody discovers afterwards what they accepted.
Decide whether to proceed, sign off on your behalf, submit anything as you, or give legal advice. Where the question is whether processing is lawful at all, it goes to your counsel with the facts attached.
Whether the obligation is annual or triggered, and whether you have the record it needs, are both answerable in a conversation before anybody is engaged.
Related services: Data Protection Compliance Program · Third-Party Security Reviews