GDPR
Data protection, minus the ring binder
GDPR can become a lot of paperwork very quickly. The useful place to start is with a few practical questions: what personal data do you hold, where is it, who can get to it, how long are you keeping it, and what happens when someone asks?
What we help with
The technical and organisational side
We handle the parts that live in your systems. Legal advice comes from your solicitor — we'll happily work with them.
Knowing what you hold
A straightforward map of the personal data in your business: which systems, which shared drives, whose inbox, and which supplier's cloud.
Access controls
Making sure HR files aren't in a folder the whole company can open, that admin rights are limited, and that leavers actually lose access.
Retention and deletion
Agreeing how long each type of record should live, then setting Microsoft 365 policies so it happens without anyone remembering.
Subject access requests
A repeatable way to search email, files and systems, and produce what's needed inside the deadline without a week of panic.
Breach response
Detecting the incident, containing it, and getting the facts together fast — the reporting window is 72 hours and it goes quickly.
Suppliers and processors
Checking which third parties touch your data, where it's stored, and whether the paperwork with them matches reality.
The first month
What we'd do in the first month
Enough to know where you stand, and to fix the things that would actually cause you a problem.
- List every system holding personal data, including the unofficial ones
- Check who can reach what, and tighten the obvious over-sharing
- Agree retention periods with you, in plain language
- Turn those periods into automatic policies where we can
- Write down the steps for a subject access request and a breach
- Review it once a year, or whenever something changes
FAQ
Questions we get asked
Not sure where your data actually lives?
Neither are most businesses until they look. We'll help you find out and tell you what's worth tackling first.