01 / Discover
Find the personal data before writing a policy about it.
- Data Mapping & Inventory
- Privacy Gap Assessment
- Records of Processing (RoPA)
- Third-Party & Vendor Review
Know what personal data you hold, and what you owe on it.
Most privacy programs fail at operations rather than policy. We map the data you actually hold, build the workflows that answer a rights request inside the statutory clock, and put the consent and vendor controls in place. Then we run them with you, or hand them over documented.
GDPR · CPRAPlus the widening set of US state laws
45 daysTypical statutory clock on a rights request
Data mapFirst deliverable, every engagement
Run or hand overManaged for you, or transferred documented
The practice
How the practice is structured
Four moves, in order. Most programs we inherit are strong at one stage and thin at the others. The assessment tells you which.
02 / Operate
Build the workflow that answers a rights request inside the clock.
- DSAR Workflow Design
- Identity Verification Process
- Deletion & Retention Workflow
- Response SLA Monitoring
03 / Control
Consent and tracking handled at the point of collection.
- Consent Management Platform (CMP)
- Cookie & Tracker Governance
- Universal Opt-Out (GPC)
- Preference Centre Design
04 / Sustain
Keep it current as the law and the data both move.
- Fractional Privacy Officer
- Managed Privacy Operations
- Regulatory Change Monitoring
- Audit & Evidence Support
The catalogue
27 services in Data Privacy
Everything on the solution map under this domain. If a requirement isn't listed, it's usually still sourceable, so ask.
Assessment 6
- Privacy Gap Assessment
- Data Mapping & Inventory
- Records of Processing (RoPA)
- Privacy Impact Assessment (PIA / DPIA)
- Third-Party & Vendor Review
- Risk-Prioritised Remediation Roadmap
Rights & Requests 5
- DSAR Workflow Design
- Rights Request Fulfilment
- Identity Verification Process
- Deletion & Retention Workflow
- Response SLA Monitoring
Consent & Marketing 5
- Consent Management Platform (CMP)
- Cookie & Tracker Governance
- Universal Opt-Out (GPC)
- Preference Centre Design
- Marketing Compliance Operations
Program & Governance 6
- Privacy Policy & Notice Drafting
- Retention Schedule Design
- Vendor Contract & DPA Remediation
- Privacy Training & Awareness
- Privacy Incident & Breach Response
- Privacy by Design Reviews
Ongoing 5
- Fractional Privacy Officer
- Managed Privacy Operations
- Regulatory Change Monitoring
- Continuous Compliance Reporting
- Audit & Evidence Support
What changes
What you actually get out of it
Not a platform choice. A set of decisions with the reasoning attached, and someone accountable for them at renewal.
- A data map that names systems and owners, not categories in the abstract.
- A rights request workflow that has been run end to end before it is needed.
- Vendor contracts and DPAs reconciled against what those vendors actually process.
- A remediation list ordered by risk, so the budget conversation has a shape.
Privacy baseline assessment4–6 weeks
01Data discovery and system inventoryDiscover
02Data map and records of processingDiscover
03Gap analysis against applicable lawDiscover
04Rights request workflow designOperate
05Consent and vendor control reviewControl
06Remediation roadmap, risk-prioritisedDeliverable
Data map firstRequest scoping
Adjacent practices
Where Data Privacy usually connects
A finding in one practice commonly implicates another. These are the three most often opened alongside this work.
25 services
SECCybersecurity
Layered defense on the NIST framework: identify, protect, detect, respond, with compliance evidence you can hand to an auditor.
Explore29 services
AIGAI Governance
Governance for the AI already running in your business, built on the NIST AI Risk Management Framework: what is deployed, who owns it, and what happens when it is wrong.
Explore15 services
ADVAdvisory & Lifecycle
The work around the technology: strategy, sourcing, the people to run it, and responsible disposal at end of life.
ExploreNext step
This practice begins with an assessment.
Scope, duration and deliverables are agreed in writing before it starts. Ask for the scope document and we will send it.