A privacy notice is only one part of managing personal data. We help you understand your processing, identify gaps and implement practical data protection processes across your business.
Whether you are preparing for customer due diligence, introducing an AI product or reviewing an existing privacy programme, we turn the work into a prioritised plan with clear owners. The objective is not a larger folder of policies. It is a privacy operating model that product, sales, people and engineering teams can use when the next processing decision arrives.
This service is designed for UK and European SaaS companies, marketplaces, health technology businesses and AI startups that have outgrown founder-led privacy decisions. The typical buyer is a COO, general counsel, DPO, security lead or founder who needs an external pair of hands but is not ready for a large in-house privacy function. It also suits a company with ISO 27001 or SOC 2 work underway that needs to answer the privacy questions those frameworks do not settle.
We work with controllers deciding why and how customer or employee data is used, processors handling data for enterprise customers, and groups with both UK and EU operations. We make the territorial scope, controller/processor relationship and international transfer assumptions explicit rather than treating “GDPR compliant” as a single generic status.
Most engagements start after a real business event: a customer security team asks who your DPO is and requests your record of processing; procurement asks for a Data Processing Agreement and subprocessor list; a US or EU launch introduces a new transfer; or product wants to train a model on support conversations. An investor, insurer or board may also discover that the privacy notice says little about retention, automated decision-making or the vendors actually receiving data.
Those moments need a defensible answer quickly. We help separate a request that needs a documented decision from one that requires legal advice, then create evidence that your team can maintain after the immediate questionnaire is closed.
Enterprise customers commonly ask for a current record of processing activities, controller or processor role, categories of data and data subjects, purposes and lawful bases, retention periods, subprocessor controls, incident notification arrangements and international transfer safeguards. They may ask how you handle access, erasure, rectification and objection requests, and whether a DPIA was completed for profiling or high-risk processing.
In practice, an auditor or supervisory authority will look for consistency: does the privacy notice match the product, do contracts match the data flow, can an owner demonstrate a rights request, and do deletion rules work in backups and SaaS tools? A policy that promises a 30-day deletion process is not useful if nobody can identify the system owner or produce a completion record.
We start with interviews and a working data-flow map covering product telemetry, account data, support systems, marketing, recruitment and suppliers. We review representative contracts and technical architecture, then assess purposes, lawful bases, minimisation, access, retention and transfer mechanisms. Where processing is novel or high risk, we facilitate a DPIA rather than copying a generic template.
Implementation can include a practical record of processing, privacy notice and cookie-consent review, rights-request workflow, breach triage process, retention schedule, supplier due-diligence method and data-processing agreement schedule. We define owners and escalation points, brief the teams who will operate each process, and test selected scenarios such as a customer erasure request or a subprocessor change. DPO appointment and legal opinions are coordinated with appropriately qualified counsel; consultancy does not replace legal advice or the accountability of management.
Depending on the agreed scope, you receive a prioritised GDPR gap register with risk and effort ratings; a data inventory and flow map; a maintained record of processing activities; controller/processor and UK/EU territorial-scope analysis; lawful-basis and retention decisions; updated privacy and transparency content; a DPIA pack for agreed processing; a rights-request and incident runbook; supplier and subprocessor review notes; and an evidence index linking each action to an owner and completion record.
For customer due diligence, we can also prepare a concise privacy evidence pack: a data-flow diagram, security and privacy control summary, transfer position, subprocessor register and answers to recurring procurement questions. The pack is written to be accurate about scope rather than promising that a certification replaces GDPR obligations.
A focused diagnostic usually takes two to four weeks: one week to collect architecture, contracts and existing documents, followed by interviews, sampling and a readout. A targeted implementation normally takes six to twelve weeks. The first phase maps processing and prioritises risk; the second updates records, notices and workflows; the third tests evidence with process owners. A complex group, extensive health data, ad-tech tracking or cross-border transfers can take three to six months.
After implementation, a monthly or quarterly advisory cadence can review new vendors, product releases, AI use cases, rights requests and incidents. GDPR compliance is maintained through change management, not achieved once when a policy is signed.
For a B2B SaaS product, useful evidence might show that billing data is retained for a defined accounting period, support recordings have a shorter operational retention, and deletion tickets are linked to system owners. For an AI feature, it may include the training-data source decision, a DPIA, user-facing explanation, opt-out route and testing record. For a European processor, it may be a subprocessor approval log, transfer impact assessment and documented use of the appropriate contractual safeguards.
Yes. We test whether the policies reflect actual processing, whether staff can follow them, and which operational gaps should be fixed first.
No. Information security controls can support privacy work, but GDPR also involves lawful bases, transparency, rights, retention, transfers and processing-specific decisions.
That depends on the nature and scale of your core processing, including whether you monitor people regularly or process special-category data at scale. We document the analysis and coordinate legal advice where needed.
A focused readiness review normally takes two to four weeks. Implementation commonly takes six to twelve weeks, depending on data sources, suppliers, product changes and how much evidence already exists.
Book a working session to talk through your current processing and where the gaps are.
Book a working session →