Know how personal data moves through your business.

Map processing activities and responsibilities, examine gaps and give the team a practical plan for improving data protection governance.

Do you need project advice or an ongoing DPO?

HR is appointing a payroll provider. The immediate decision is what needs to happen before employee data is shared.

Choose the support

Scoped project: Map the data flows, review supplier arrangements and identify actions for the rollout.
Ongoing vDPO: An appointed vDPO advises independently, monitors compliance and can raise concerns with senior management.
Management’s role: Bring the proposed agreement, processing record and decision to be made. Management owns the decision.

Explore the vDPO appointment

Engagement scope

Build a defensible picture of processing

Map purposes and responsibilities

For UK processing, identify the controller and any processors. Record each purpose, the lawful basis relied on, the personal data involved and who receives it. Identify whether the EU GDPR or other regimes also apply.

Review the evidence and gaps

Examine privacy information, rights requests, retention, processor contracts and international transfers where relevant. Carry out a data protection impact assessment before processing likely to result in high risk to individuals.

Set owners and priorities

Agree the work, the people responsible and how progress will be reviewed. Discuss specialist data protection support where it is needed.

Which processing activity or data flow do you need to understand?

Discuss data protection ↗