Skip to content

Privacy & Data Protection

Privacy programmes that fit how your business uses personal data and work in practice, so you can show regulators, customers and auditors how it is protected.

Discuss your matter

Typical deliverables

  • Data map and records of processing
  • Privacy notices, policies and procedures teams can follow
  • DPIAs, LIAs and transfer impact assessments
  • Data processing and transfer agreements
  • Reusable customer privacy assurance pack
  • Breach response and notification procedure

A cross-jurisdiction capability, supported across the jurisdictions in our directory. See jurisdictions

Overview

Why it matters

Regulated digital businesses process personal data at scale: identity documents, payment data, behavioural data and, often, data about vulnerable customers. The same data drives AML, fraud and marketing processes, so privacy has to be built into how the business operates, not set out in a policy alone — and that is what customers, partners and supervisory authorities look for.

We build privacy programmes from a map of what data you hold, why you hold it and where it goes, and then help run them: ownership and governance, the policy and documentation framework, impact assessments, vendor oversight, training, and the evidence that customers and auditors ask for — ready when a launch or a customer review needs it.

Where the GDPR applies, we build the programme to its full requirements. Elsewhere we work to the privacy laws that govern your processing — from the UK GDPR and US state laws to the LGPD, POPIA and India's DPDPA — as one programme that extends to new markets, and coordinate local advice where it is needed.

Privacy work is coordinated with our Information Security & Cybersecurity and AI Governance practices, so the data, systems and controls they share are governed consistently.

Key services

From the first gap analysis to the external audit

We identify the gaps, design the programme, help implement it and support you through review by auditors, enterprise customers and regulators, with the evidence each expects.

Fractional CISO / External DPO

Senior security and privacy leadership on an agreed monthly scope, for businesses that need a CISO or a DPO without the cost of a full-time internal function.

  • Strategic planning, gap identification and a remediation roadmap
  • Programme governance, policy architecture and risk oversight
  • Vendor risk, incident preparedness and awareness training
  • Guidance for internal teams, and reporting to management
  • Support with customer security reviews and audit preparation

A CISO and a DPO are different roles. A CISO leads the security programme; a DPO carries out the tasks the law assigns to the role — monitoring compliance, advising on impact assessments and acting as the contact point for the supervisory authority — and acts independently. As your external DPO, we take on those tasks under a service contract.

Certification & External Audit Support

Support through the whole readiness and audit process — for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification, SOC 2 examinations and other external audits — from the first gap analysis to closing the findings.

  • Building or refining the framework the audit will test
  • Gap analysis against the standard or criteria
  • Policies, procedures, registers and evidence prepared for review
  • Teams prepared for auditor interviews
  • Evidence gathering coordinated across the business
  • Acting as your coordination point with the external auditor, including in audit sessions
  • Remediation of audit findings

Certification and attestation decisions rest with the independent certification or audit body; ROZSUD is not a certification body and does not issue certifications. Our role is to have you ready for that review.

Enterprise Sales & Customer Assurance

Security, privacy and, increasingly, AI reviews are a routine step in enterprise procurement. We help you respond accurately and quickly, so your answers keep pace with the deal — removing security and privacy blockers without overstating the controls behind them.

  • Customer security and privacy questionnaires
  • RFIs and the security sections of RFPs
  • Vendor due diligence and security reviews
  • Enterprise procurement and contractual security requirements
  • Customer audit requests
  • A reusable assurance pack of policies, summaries and evidence

Third-Party Security & Privacy Due Diligence

An independent assessment of a vendor, partner, investee, acquisition target or other strategic counterparty, so you know the risks before you rely on it or invest in it.

  • Scope agreed around the relationship and the risk it carries
  • Document review, interviews and evidence sampling
  • A structured report of control gaps, material risks and compliance concerns, with remediation recommendations you can act on

This is a security and privacy assessment, not a statutory financial audit.

Scope

What we do

Programme & governance

  • External DPO & Privacy Leadership

    Your designated external DPO, or senior privacy leadership working alongside your in-house team.

  • Privacy Programme Design & Implementation

    A privacy programme sized to the business — ownership, controls and processes — designed and put into operation, so it produces the evidence reviewers ask for.

  • Privacy Governance

    Roles, decision rights, management reporting and a forum that keeps privacy decisions consistent across products and entities.

  • Policies & Procedures

    Privacy and cookie notices, internal policies, retention schedules and the procedures teams follow — one framework that matches how you actually process data.

  • Privacy Awareness Training

    Awareness training for all staff, and role-based training for product, engineering, marketing and customer-facing teams.

Compliance & assessments

  • GDPR & Global Privacy Compliance

    The GDPR for EU operations and for businesses outside the EU that serve or monitor people in the EU, and the other privacy laws that apply to you, managed as one programme.

  • Data Mapping & Records of Processing

    Personal data mapped across systems, vendors and group entities, and records of processing activities (ROPA) your team can keep current.

  • DPIAs & Privacy Impact Assessments

    Data protection impact assessments (DPIAs) for high-risk processing, and privacy impact assessments (PIAs) for new products, vendors and changes, before they go live.

  • Legitimate Interests Assessments (LIAs)

    Documented balancing tests for legitimate-interests processing, ready to show when asked.

  • International Data Transfers & TIAs

    Transfer mechanisms and transfer impact assessments (TIAs) for the personal data flows your business relies on, out of the UK, the EEA or other restricted jurisdictions, including within the group.

  • Data Processing Agreements

    Controller–processor and joint controller agreements, and the data protection terms in commercial contracts, drafted and negotiated.

Assurance & incidents

  • Vendor & Privacy Due Diligence

    Privacy review of vendors and partners before onboarding, and oversight of processors after it.

  • Customer Privacy Assurance

    Privacy questionnaires, DPA negotiations and due diligence requests from enterprise customers, handled consistently and in step with the sale.

  • Privacy Audit Readiness

    Independent review of the programme against the applicable law, and preparation for ISO/IEC 27701 certification and customer audits, with gaps addressed beforehand.

  • Data Breach & Incident Governance

    Breach response procedures and decision-making, notifications to supervisory authorities and individuals within statutory deadlines, and the remediation that follows.

Frameworks

Frameworks, standards & regulations

Standards and frameworks are chosen — to certify against, to report on or to give a programme its structure. Regulations and legislation apply by law, according to where the business operates and what it does. We work with both, mapping one set of controls to the requirements that apply, so you can run and evidence one programme rather than several.

Standards

ISO/IEC 27701
Privacy information management systems (PIMS): requirements and guidance for managing personal data.

Regulations & legislation

Europe & United Kingdom

GDPR
General Data Protection Regulation, Regulation (EU) 2016/679.
ePrivacy Directive
Directive 2002/58/EC on privacy in electronic communications, including cookies and electronic marketing, as implemented nationally.
UK GDPR & Data Protection Act 2018
The United Kingdom's data protection framework.

United States

CCPA / CPRA
California Consumer Privacy Act, as amended by the California Privacy Rights Act.
VCDPA
Virginia Consumer Data Protection Act.
CPA
Colorado Privacy Act.
CTDPA
Connecticut Data Privacy Act.
UCPA
Utah Consumer Privacy Act.
FDBR
Florida Digital Bill of Rights.
HIPAA
Privacy and security requirements for protected health information, where they apply to the business or its customers.

Other jurisdictions

PIPEDA
Personal Information Protection and Electronic Documents Act (Canada).
LGPD
Lei Geral de Proteção de Dados Pessoais (Brazil).
POPIA & PAIA
Protection of Personal Information Act and Promotion of Access to Information Act (South Africa).
DPDPA
Digital Personal Data Protection Act, 2023 (India).

Working with us

Engagement formats

Every engagement is scoped in writing before work begins, in one of these formats or a combination of them.

  • Focused advisory session

    A prepared consultation on a defined security, privacy or AI-governance question, followed by practical action points.

  • Scoped deliverable

    Preparation, review or improvement of a specific policy, procedure, assessment, register, methodology or other governance deliverable.

  • Fractional support

    Ongoing senior security, privacy or AI-governance support under an agreed monthly scope.

  • Programme build or remediation

    Building or improving an ISMS, PIMS, AIMS or broader compliance programme against an agreed framework.

  • Audit & customer assurance support

    Preparation for certification audits, customer audits and enterprise security or privacy reviews, and the remediation that follows.

  • Third-party assurance

    Independent security and privacy assessment of a vendor, partner, investee, acquisition target or other third party, with findings and recommendations.

We set out the timetable for our work in the written scope before it starts. It reflects the size of the organisation, its current maturity, its product and geography, the framework selected and the scope of any audit; the certification date itself follows the audit.

Jurisdictions

Supported across jurisdictions

We support Privacy & Data Protection across the jurisdictions in our directory, adapting the work to what each jurisdiction's law requires and coordinating local specialists where local law, registration, representation or professional requirements require it.

Cartography by ROZSUD from Natural Earth data (public domain).
Europe18
Asia & Middle East4
Americas & Caribbean11
Africa & Indian Ocean6

Industries

Where we apply it

Questions

Frequently asked

Does the GDPR apply to us if we are not established in the EU?

It can. The GDPR applies to businesses outside the EU that offer goods or services to individuals in the EU or monitor their behaviour there, and such businesses may also need to appoint a representative in the EU. We confirm whether and how it applies first, so the programme covers what is required.

Do we need a data protection officer, and can you act as one?

A DPO is mandatory in defined cases — for example, where core activities involve regular and systematic monitoring of individuals on a large scale — and many regulated digital businesses fall within them. Where a DPO is needed, we can act as your external DPO or support the DPO you appoint.

How do AML obligations fit with data protection?

AML rules require you to collect and keep data that privacy law requires you to minimise and protect. We reconcile the two through clear lawful bases, retention schedules and access controls, designed together with your AML framework so compliance and privacy teams work from the same rules.

Can you prepare us for ISO/IEC 27701 certification?

Yes. We build or refine the privacy information management system, prepare the documentation and evidence, act as your coordination point with the auditor and, after the audit, help you close any findings it raises.

Related

Related practice areas

  • Information Security & Cybersecurity

    Fractional CISO support, ISMS and security programmes, certification and audit readiness, DORA, NIS2 and customer assurance for enterprise sales.

  • AI Governance

    Governance that lets AI adoption scale: EU AI Act readiness, ISO/IEC 42001 management systems, AI risk and impact assessments, and vendor risk.

  • Commercial & Technology Contracts

    Platform, white-label, B2B supply, SaaS, affiliate and outsourcing agreements, drafted and negotiated to close deals in regulated markets.

  • AML & Financial Crime Compliance

    AML/CFT programmes, MLRO-as-a-Service, independent AML/CFT audits, risk assessments, monitoring, sanctions and inspection support.

All practice areas

Need an external DPO or a privacy programme that works in practice?

Walk us through how you use personal data and where you operate. We look at which laws apply and where to begin, and follow up with a written proposal setting out scope, timetable and fee.

Request a consultation