Every business that handles personal information about customers, staff or suppliers must comply with the UK GDPR and the Data Protection Act 2018. We help you understand what that means in practice and put the right documents and procedures in place.
Policies and notices
- Privacy notices for customers, website users and employees
- Cookie policies and consent mechanisms
- Internal data protection and information security policies
- Retention schedules
Compliance
- Identifying your lawful bases for processing and documenting them
- Data processing agreements with suppliers, and international transfer arrangements
- Data protection impact assessments for higher-risk processing
- Maintaining your record of processing activities and registration with the Information Commissioner’s Office
When something goes wrong
- Responding to subject access requests and other individual rights requests
- Handling personal data breaches, including assessing whether the ICO and individuals must be notified within the statutory 72 hours
- Dealing with complaints and ICO enquiries
We give proportionate advice: the aim is compliance that fits the size and risk profile of your business, not paperwork for its own sake.