Since 2013 · What we do
Comprehensive solutions to keep your business compliant, secure, and resilient.
Since 2013 we have kept businesses compliant. Four core practices and a set of supporting workstreams, each scoped on its own or combined into a single programme with one engagement manager, one timetable, one point of accountability and one invoice.
Core practices
Where most engagements begin
GDPR Audits
Evaluate your processes to ensure full compliance with GDPR regulations. We examine what you actually process, on what lawful basis, for how long, with whom, and whether you can prove it. Typical duration four to eight weeks.
Read the full scopeCybersecurity Risk Assessments
Identify vulnerabilities and prevent potential cyber threats. Interviews, document and configuration review, sampling and targeted technical validation, producing risk you can actually act on. Typical duration three to six weeks.
Read the full scopePenetration Testing
Simulate attacks to find weaknesses before hackers do. External and internal networks, web applications, APIs, cloud configuration and social-engineering simulations — strictly within signed rules of engagement.
Read the full scopeIncident Response
Rapidly detect, contain, and remediate security incidents to minimise damage, with Article 33 and Article 34 notification assessed in parallel so the regulatory deadline is never the thing that slips.
Read the full scopeSupporting workstreams
The work that keeps a programme alive
Compliance is not a project with an end date. These workstreams are delivered as standalone pieces or folded into a retained advisory arrangement.
Data Protection Impact Assessments
Article 35 DPIAs for high-risk processing: large-scale profiling, special-category data, systematic monitoring, new technologies and automated decision-making. We produce the assessment, the mitigation plan and, where residual high risk remains, the Article 36 prior-consultation pack.
International transfers
Transfer mapping, adequacy analysis, Standard Contractual Clause module selection, and transfer impact assessments addressing third-country access to data in line with the Schrems II judgment and EDPB supplementary-measures guidance.
Data subject request handling
A defensible process for access, rectification, erasure, restriction, portability and objection requests: identity verification, search scoping, third-party and legal-privilege redaction, exemption analysis and the one-month response clock.
Vendor & supply-chain due diligence
Processor assessment under Article 28, security questionnaires proportionate to risk, contract schedule review, sub-processor chain mapping, and the ongoing monitoring that Article 28(1) expects of a controller.
Training & awareness
Role-specific training for engineering, marketing, HR and support teams, executive briefings for boards carrying the accountability, and tabletop exercises that test whether the incident plan survives contact with reality.
Outsourced DPO support
Where Article 37 requires a Data Protection Officer, or where you want the function without the headcount: register maintenance, advice logging, supervisory-authority liaison and an independent reporting line to the highest management level.
Proportionate scoping
The same law, a different proportionate response
Growing businesses
You have customers asking privacy questions in procurement, a security questionnaire you cannot honestly complete, and no formal programme behind the answers. The goal is not a perfect programme — it is a defensible one, built quickly, that will not embarrass you in a diligence process.
- Records of processing, privacy notice and retention schedule in one pass
- A processor register and the Article 28 terms you are missing
- An incident plan short enough that people will actually use it
- A single external security assessment to establish a baseline
Enterprise and group structures
Multiple controllers inside one group, intra-group transfers, a vendor estate in the hundreds, a lead supervisory authority under Article 56 and an internal audit function that wants evidence rather than assurance. The work is as much about governance design as it is about law.
- Controller/processor/joint-controller mapping across group entities
- Article 26 joint controller arrangements and intra-group agreements
- Country-by-country counsel coordinated through one workstream
- Board-level risk reporting on a quarterly cadence
Regulated and public-sector bodies
NIS2 obligations for essential and important entities, DORA for financial entities and their critical ICT providers, sectoral codes, and procurement security schedules — all sitting on top of the data-protection baseline. We map controls once and evidence them against several duties.
- Obligation mapping across GDPR, NIS2, DORA and sectoral rules
- Management-body accountability and training requirements addressed
- Incident reporting timelines reconciled across overlapping regimes
- Evidence packs structured for inspection rather than for reading
Commercial terms
How engagements are structured
| Element | Standard position |
|---|---|
| Scoping call | No charge, no obligation, no engagement formed. |
| Engagement document | Written proposal or statement of work setting out scope, assumptions, timetable, named personnel, dependencies, deliverables, fees and acceptance criteria. |
| Scope changes | Written approval required. Changes may affect fees, timetable, personnel and test windows. |
| Invoicing | Due within 14 days unless the engagement states otherwise. Genuine disputes must be raised promptly; undisputed amounts remain payable. |
| Data protection | Where we process personal data on your behalf, our Data Processing Agreement applies as Article 28 processor terms. |
| Deliverable licence | Non-exclusive, non-transferable internal-use licence, subject to payment. Onward reliance by third parties requires written permission. |
| Liability | Capped as set out in section 25 of the Terms of Service, subject to mandatory law and any different cap expressly agreed. |
| Termination | As stated in the engagement; otherwise 30 days' written notice, subject to payment for work completed and committed costs. |
Scope and limitations. Not every service is available in every country or to every client. Services are supplied subject to our Terms of Service and the applicable written engagement; where the two conflict, the signed engagement governs the specific service to the extent of that conflict. Nothing on this page is legal advice, a certification, a regulatory approval, or a guarantee of any outcome.
Next step
Tell us what is driving the deadline.
A procurement questionnaire, a regulator's letter, an acquisition, a failed test or a board that has started asking questions. The pressure shapes the scope.