Data Protection Consultancy and Advisory Service

Assurance - We will conduct an independent and evidence-based assessment of your organisation's current level of data protection compliance. This will be followed by a detailed report on our findings and a draft remediation plan to assist you in establishing the appropriate project plan and scope to address any relevant gaps.

Due Diligence - Our due diligence service is a high-level view of compliance, often used by clients looking to acquire or merge with another organisation. This service is usually provided alongside other practice areas within our firm.

Third-party vendor compliance - Audits should be conducted with service providers who process personal data, allowing you to assess and mitigate any possible risks. Our experts will evaluate the state of data protection compliance in terms of the regulatory and contractual obligations set out in the relationship.

Our suite of data protection-related policies and procedures allows our clients to rely on accurately drafted templates which are up-to-date at the time of sourcing. We can provide these as a pack for you to implement, or our experts can assist in tailoring these to ensure they are suitable and adopted appropriately.

Annual Review Service – Clients can take comfort in relying on our annual review service. Our experts will conduct a one-yearly review of your existing policies and procedures, ensuring they are up-to-date with relevant legislative developments and suitably aligned to your organisation's operational activity.

Sense check – We can provide a sense check of existing policies and procedures and ensure they are accurate but, importantly, that your employees understand the rules that apply and the processes which must be followed to demonstrate compliance with your organisation's data protection obligations

Our team of expert lawyers are well versed in data sharing arrangements; whether the data sharing is in the UK or elsewhere in the world, they can assist you in understanding the appropriate data protection contracts and safeguarding measures required to comply with the law.

Data Protection legislation requires organisations to assess and evaluate the risk of processing activities. A range of different assessment templates are available, and our team of experts can assist with an independent review of your risk and impact assessments.

Individuals have a right to access their personal data; our experts can assist you with compiling, reviewing and redacting, and advising on the scope of such requests.

Training staff and keeping them informed of their obligations is extremely important. We offer tailored data protection-compliant training, which can be delivered in person or virtually.

Some data protection events can be complex and challenging to navigate. Our team of experts has extensive experience in supporting our clients with complex data protection scenarios.

Our Complex Individual Requests service allows you to rely on our expertise to comply with an individual’s requests, for example DSARs. In these scenarios, we often find that there is a need for multidisciplinary support, for example, employment or regulatory expertise. As a full-service law firm, we have access to the experts in all related areas and can call upon these teams as required.

Security Breach Management - In cases of a security breach of personal data, it is always best to ensure you have legal support as early as possible. In these events, there are often many complex risks and issues to navigate. Our cyber security experts have first-hand experience dealing with these matters in a range of different sectors.

Regulatory engagement - No one wants to be on the receiving end of dealing with regulators; it can feel daunting. As such, our team of data protection and regulatory experts can assist you with navigating your way through handling regulatory engagements.

International Transfers - The international transfer of personal data is becoming a complex landscape. Recent regulatory fines on organisations for failing to comply with the ‘risk-based approach’ to international data protection transfers highlight the importance of doing this right. Our data protection team have extensive experience in assisting clients with understanding their data transfer obligations about international data transfers. We can also rely on our international legal partners to help with multi-jurisdictional considerations for data flows from other territories.

Our advisory service allows your organisation to either fully adopt a data protection expert to support your organisation, fulfilling a DPO-like function carrying out the DPO's designation, position and tasks. However, we understand this isn't always required. As such, our flexible approach to our service allows our clients to rely on a range of different options.

(1) DPO Advice Support - The DPO can often find themselves in complex, confusing and/ or conflicting situations that may require a fresh-view perspective on the specific matter. Our DPO Advice Support allows our clients with a DPO or Data Protection professional to have access to our experts to assist with queries and/ or issues in discharging their duties.

(2) Retainer Service - Based on a monthly fee, you select the time required to assist your organisation with day-to-day data protection advice.

(3) One-off Advice - Data Protection compliance can sometimes throw curveballs. As such, while some of our clients may not require a formal arrangement with our experts, we can be called upon for one-off engagements of advice on data protection matters as and when you need us.

(4) Outsourced/ Interim DP Expert - Our outsourced and interim Data Protection expert solution gives you a directly appointed individual to support your data protection compliance duties. This service acts similar to having your own appointed DPO but with a flexible and cost-efficient approach to the role. We would always start this engagement by carrying out our assurance audit to get a clear picture of your existing compliance, advise on an appropriate number of days per month to carry out the job and establish a data protection compliance remediation plan.