Data and Information Governance
Good data protection is about knowing what personal information you hold, why you hold it and who you share it with. We help you build the records, agreements and habits that show you are in control.
How We Can Help
- DPO activities. Support for your Data Protection Officer or the person who looks after data protection, from monitoring compliance to advising on risks and reporting to your board.
- Records of processing (ROPA). Building and maintaining the record of what personal data you process, why, where it is kept, who sees it and how long you keep it.
- Data sharing agreements. Drafting, reviewing and agreeing the terms for sharing information with partners, councils, health bodies and other organisations.
- Data Protection Impact Assessments (DPIAs). Working through the risks of new systems, projects and uses of data, including AI tools, before you go live.
- Supplier and processor checks. Making sure the companies that handle your data have the right contracts and safeguards in place.
- Breach and request handling. Clear procedures for reporting and managing data breaches, and for responding to subject access and other individual requests.
- Policies, privacy notices and retention. Short, plain-English documents and retention schedules that people can follow.
- Training and awareness for staff, managers and trustees.
Who We Help
We work with housing providers, care organisations, charities, schools and colleges, and growing businesses. Many of these hold sensitive information about residents, patients, learners or service users, and are often asked by funders, partners and regulators to show how they protect it.
A Practical Approach
- Understand. Find out what personal data you hold and where it goes.
- Assess. Compare your current practice with UK GDPR and the Data Protection Act 2018, and agree the gaps worth fixing first.
- Put it right. Build the records, agreements, notices and procedures you need.
- Keep it going. Review regularly, so your records stay accurate and people know what to do.
We give practical guidance to help you meet your obligations. This is not legal advice, and for legal opinions we will tell you when to involve a solicitor.
Data protection works hand in hand with security. See our cyber security and ISO 27001 support, and our advice on using AI safely.
Frequently Asked Questions
How long does it take to build a ROPA?
For a small or medium-sized organisation it usually takes a few weeks, depending on how many teams and systems hold personal data and how available people are to talk to us.
What does it cost?
It depends on what you need, from a one-off ROPA or data sharing agreement to ongoing support. We give you a clear quote after a free discovery call. All prices exclude VAT.
What do you need from us?
A named contact, a list of your main systems and suppliers, and any existing policies, contracts and agreements. We will arrange short conversations with the teams who use personal data.
Can you act as our Data Protection Officer?
We can support your DPO and carry out many of the activities a DPO does. Some organisations must appoint a DPO who is independent and free of conflicting duties, so we talk through what is right for you before agreeing anything.