GDPR and Data Protection Review
Clear records and controls that stand up to questions.
- How long2 to 4 weeks
- How we workFixed package
What you receive
Clear records and controls for the personal data in your apps and AI tools, that stand up to questions from customers and regulators.
Where does personal data go?
You receiveA map of where personal data flows
You cannot protect what you cannot see.
What it is. A diagram of the personal data you collect, where it is stored and who it is shared with.
Why it matters. You cannot protect what you cannot see.
Do we have the records the law asks for?
You receiveA record of processing
You can answer a regulator or a customer with confidence.
What it is. The written record GDPR expects: what data, why, for how long and with whom.
Why it matters. You can answer a regulator or a customer with confidence.
Is our AI use safe for people's data?
You receiveA DPIA for AI or high-risk processing
Required for high-risk processing, and good protection for you.
What it is. A data protection impact assessment: a structured look at the risks to people and how you reduce them.
Why it matters. Required for high-risk processing, and good protection for you.
How long should we keep data?
You receiveRetention rules
Less data held means less risk.
What it is. Clear rules for how long each type of data is kept and when it is deleted.
Why it matters. Less data held means less risk.
Are our suppliers handling data properly?
You receiveA supplier and contract checklist
Your suppliers' mistakes do not become your liability.
What it is. A checklist of suppliers that touch personal data and the contract terms you need.
Why it matters. Your suppliers' mistakes do not become your liability.
Does our privacy notice tell the truth?
You receivePrivacy notice updates
Honest notices build trust and meet the law.
What it is. Your privacy notice updated to match what you really do.
Why it matters. Honest notices build trust and meet the law.
What do we need to fix?
You receiveAn action plan
Compliance becomes a clear list of jobs, not a worry.
What it is. The gaps in order, with owners and dates.
Why it matters. Compliance becomes a clear list of jobs, not a worry.
From brief to done
- 1
Week 1
Map
Data flows mapped with your team.
- 2
Weeks 2 to 3
Assess
Records, the impact assessment, retention and suppliers.
- 3
Final days
Plan
Notice updates and the action plan.
What can a stranger see about our systems?
Outside-in security look. What anyone on the internet can see about your systems, and the five fixes that matter most.
- You give us written permission and the addresses to check
- We check certificates, email settings and anything exposed, from the outside only
- A short report with the fixes in order
- It is free. There is nothing to pay and nothing to sign.
- The report is yours to keep and share, whatever you decide.
- No sales call unless you ask for one.
Questions people ask
How much does it cost?
We send a written quote after your request: what it covers and what it does not. The tier, scope and timing set the price.
Could I just use AI for this?
AI drafts code and prototypes quickly, and we use it every day. It cannot decide what to build, prove that it is secure, or answer for it when real people rely on it. That is the part you are hiring us for.
Who owns the work?
You do. Code, designs, files and documents are yours, and the quote says so in writing.
Can we change the scope?
Yes. If something needs adding or removing, we agree it in writing before we do it.
What happens after?
Most people go on to Security Health Check, but there is no obligation. You keep everything we made.