How we have helped organisations like yours
Real engagements, from UK small businesses to global organisations: where they started, what was at stake and what changed.
A bowling and leisure venue
The situation
The business processes personal data about employees, customers, suppliers and freelancers, and knew it needed to meet its UK GDPR obligations. It had no in-house data protection expertise.
The challenge
There were no documented data protection policies or procedures and no risk assessments, and the venue had already received data subject access requests. It also uses CCTV and facial recognition technology on site. Without risk assessments for these technologies, it could not show that individuals' rights and freedoms were protected, leaving it exposed to reputational damage and lost revenue.
How we helped
We helped the venue close its existing compliance gaps and put governance in place, so roles and responsibilities are clearly understood and documentation is reviewed and updated as needed.
A global events management agency
The situation
The agency's Legal and Risk Manager was retiring, and it needed support to keep meeting its data protection obligations.
The challenge
Several policies and procedures were in place, but core responsibilities were outstanding, including a Record of Processing Activities (ROPA) and risk assessments. The agency had no clear view of its data processing risks and no assigned ownership for data protection governance.
How we helped
We produced a prioritised remediation plan to close the compliance gaps. The agency now knows what it needs to do, with clear visibility of its risks and the actions and timescales in place to address them.
More of our team's work
Our team's experience covers the public and private sectors, in the UK and internationally. Clients are not named, to protect their confidentiality.
Building data protection foundations for a Caribbean bank
A large financial institution in the Caribbean had no procedures for recording consent, no guidelines for retaining personal data and no privacy notices. These gaps were closed, with clear roles and responsibilities for keeping the new documents up to date. A data protection platform was also set up, where several DPIAs were completed and a comprehensive risk register compiled.
Reviewing UK data protection controls for a global bank
A global financial institution needed to confirm that its UK data protection controls were fit for purpose. Every control was reviewed, with quarterly reports to senior stakeholders. Changes to some controls were then implemented without disrupting day-to-day operations, and several policies were updated to align with them.
Privacy assessments and data flows for an Irish financial institution
A wealth management and investment banking firm needed several privacy assessments to support its data processing. Awareness of key data protection documentation was low, so a technical standard was written explaining what documentation is needed to evidence compliance, and why. The data flows for a new technology used to assess eligibility for its products were also documented.
Data retention for a London local authority
The council held large amounts of residents' personal data without clearly defined retention periods, so much of it was kept for longer than necessary. After a review of the data held, clear retention guidelines were put in place for every type of personal data and data due for deletion was identified. Once it was deleted, the authority made significant savings on storage costs.
A compliance platform for a major UK government department
One of the UK's largest government departments had no central way to manage its data protection compliance. A new platform was set up from scratch, the data protection team and users across the department were onboarded and trained, and its day-to-day operation was managed. The department can now report easily on its compliance, internally and across government.
A global data retention policy for a beverage retailer
A global beverage retailer with several brands was keeping customers' personal data for too long. The project mapped every type of data processed, set a retention period for each and produced a global data retention policy. Individual countries can now set retention periods for locally relevant data while staying aligned with the global policy.
Data quality standards for a global coffee retailer
The company had no consistent data quality standards across the business. Standards were defined in line with industry best practice, and principles, rules and metrics were documented as part of a data classification framework and standards repository.
A gap analysis for an Irish sports retailer
The retailer asked for a gap analysis of its activities to find its data protection compliance gaps. The resulting remediation activities were discussed and prioritised, and work began on data protection impact assessments (DPIAs) for several new systems that process personal data.
DPIAs for a global construction company
The company needed several data protection impact assessments (DPIAs) to understand the risks of its processing. Working with stakeholders across the business, the assessments were completed with the people responsible and the processing risks identified, giving the company what it needed to find its compliance gaps and plan the work to close them.
Email tracking and consent for a Canadian marketing platform
An email marketing platform needed to know what to change to meet EEA consent requirements for tracking pixels in emails. Alongside external legal counsel, who set out the specific legal requirements, a full DPIA was completed covering the risks of the tracking data and the safeguards needed to transfer data from the EEA to the company's data centre in the USA.
Cookie compliance across a global media company's websites
The company's brand websites gave visitors no way to accept or reject first- and third-party cookies, so they did not meet local regulations. A programme of work put compliant cookie banners on every site, with clear wording about each type of cookie, and tested them all. When the company later moved to a new consent platform, every banner was migrated and tested again.
Retention and transparency for a UK charity
The charity was keeping personal data for too long and its policies were out of date. Its privacy notice was reviewed and updated so it is compliant and transparent for everyone who interacts with the charity, and a data retention policy was produced with procedures for sharing sensitive personal data internally.
A data protection strategy for an events company
The company had no strategy or documented procedures to show its compliance. A data protection strategy was written and work began on the key areas needing remediation. A data protection platform was set up and all staff trained to use it, and new policies and procedures were rolled out alongside data protection awareness training.
Meeting regulator expectations for a beauty clinic
A beauty treatment clinic needed its data protection compliance to meet the expectations of its industry regulator. Several assessments were completed and the clinic's policies and procedures reviewed. A related beauty company was also supported with a review of its policies, its Record of Processing Activities and its controls.
Where does your organisation stand?
Every engagement starts the same way: a free review of where you are today, and what's worth doing first.