GDPR · DATA PROTECTION
Turn data protection responsibilities into everyday practice.
Personal data moves through customer systems, HR processes and supplier services. We help you understand that flow, clarify responsibilities and put workable privacy practices in place.
Start with how personal data is used
A privacy notice is only one part of data protection. The starting point is understanding what information you collect, why you need it, who can access it and how long it is kept. GDPR responsibilities depend on the processing and your role. An organisation can be a controller for one activity and a processor for another.
Connect responsibilities with practical work
We help connect the documentation with the people and systems that handle personal data. The work can cover processing records, supplier responsibilities, access and retention practices, requests from individuals and how privacy incidents are handled. Where a risk assessment or data protection impact assessment is needed, the scope and responsibilities are established with your team.
Agree a focused starting point
You might be introducing a new service, changing an HR system, reviewing cloud suppliers or trying to understand gaps in existing documentation. Start with the activity that needs attention. We agree which processes and systems to review, which people should take part and what information is needed before proposing the next steps.
Use the findings to make improvements
An engagement can produce a processing map, a list of documentation gaps, recommendations for procedures and a prioritised action plan. Each action should have an owner and a clear completion criterion. Your organisation retains responsibility for its processing decisions; a report on its own does not establish compliance.
Questions to bring to the first discussion
- Which processes involve personal data, and which change or concern prompted the review?
- Are you acting as a controller, a processor, or both in different activities?
- Which suppliers and transfers need to be understood?
- What documentation and internal procedures are already available?
Related support
Scope and deliverables are agreed before work starts. A formal data protection officer appointment is a separate arrangement, not an automatic result of buying advisory support.