Process

We begin with an initial consultation to understand your organisation, outline our service and gain an overview of your requirements, systems and objectives.

We carry out a detailed review of the applications and platforms you use, building a clear picture of the systems involved in the processing activity.

We map the personal data collected, used, shared and stored across each application so there is a clear record of what data is involved and how it moves through the process.

Using the information gathered, we complete the DPIAs in full, documenting the nature of the processing, assessing necessity and proportionality, and recording risks, mitigation measures and recommended actions.

The completed DPIAs are then presented to you as formal deliverables, ready for review, internal use and retention as part of your compliance records.

We work with relevant staff and stakeholders to review the completed DPIAs, confirm that the documented processing reflects operational practice and support formal sign-off by the appropriate decision-makers.

DPIAs should remain under review as processing activities evolve. We recommend an annual review cycle, with earlier reassessment where any significant change to the processing, systems, suppliers or risk profile triggers the need to revisit the DPIA.