Governance: keep it working
Controls drift as systems, vendors and teams change. We keep them current with regular reviews, DPO support and a breach plan your team has already rehearsed.
Review, test, update, report
The same four quarters each year, so nothing is left to the week before an audit.
- Q1 Review
Data map and vendors re-checked.
- Q2 Test
Breach drill and rights-request test.
- Q4 Report
A plain status note for leadership.
- Q3 Update
Notices, policies and controls refreshed.
What we provide
- 01
DPO support
An outside Data Protection Officer, or backing for the one you have.
- 02
Periodic reviews
Scheduled checks against the Act and the Rules as they change.
- 03
Breach runbooks
Who does what, and who is told, when personal data is exposed.
- 04
Vendor monitoring
Processors re-assessed as contracts renew.
Questions
The Act requires one for organisations designated as Significant Data Fiduciaries. Other organisations can still name a privacy lead, and we can support either.
The Act asks you to tell the Data Protection Board and the people affected. The form and timing come from the Rules, and CERT-In has its own rules for cyber incidents. We set out who does what in your runbook and confirm the detail with your legal team.
Yes, if your controls are already in place. We begin with a review to see what to fix first.