Data Protection & GDPR Compliance

For a regulated firm or a large organisation, data protection is not a discrete compliance exercise. It runs through onboarding, outsourcing, marketing, HR, monitoring, retention and every third-party arrangement.

We build the framework: the assessments, the records, the policies and the agreements that evidence compliance. 

Common areas of exposure 

• The obligations overlap but do not align. A regulated firm holds client data under record-keeping obligations, AML data under separate legislation, and communications under recording requirements. Retention periods prescribed by financial services regulation frequently exceed what a data minimisation analysis would support, and the interaction has to be reasoned and documented rather than assumed.
• Outsourcing chains. Custody, execution, IT, cloud infrastructure, KYC utilities, marketing and CRM providers. Each is a processor requiring an Article 28 contract, and each sub-processor extends the chain further.
• Monitoring. Call recording, communications monitoring and staff surveillance carry their own assessment and transparency requirements.
• Automated processing. Profiling and automated decision-making engage Article 22 and require specific safeguards.
• Marketing and lead generation. Affiliate arrangements, lead purchasing and profiling are among the most frequently examined areas, and the ePrivacy rules apply alongside the GDPR.

Key services

• Gap analysis. Compliance with GDPR requires a combination of legal, business and technical skills from GDPR experts. We will perform a detailed analysis mapping the present position your organisation is at in terms of GDPR compliance, exposures to the legislation and the distance to be covered in order for your operations to be compliant.
• Data protection impact assessments. Required under Article 35 where processing is likely to result in high risk - including systematic monitoring, large-scale processing of special category data, automated decision-making, and new technologies.
• Lawful basis assessment. Each processing activity requires a basis under Article 6; special category data requires a further condition under Article 9. Where legitimate interests is relied on, a documented balancing assessment is required. Consent, in an employment or customer context, is frequently the wrong basis.
• Policies and procedures. Tailored data protection policy, retention and deletion schedule, access request and breach response procedures, and the governance around who decides what.
• Data subject rights handling. Access, rectification, erasure, restriction, portability and objection. Access requests in employment and regulated contexts are frequently complex.
• Breach Response. In the event of a data breach, notification to the Commissioner within 72 hours where the criteria are met, communication to data subjects where the risk is high, and an internal breach register regardless.
• Health checks/yearly verifications. If your organisation already has a GDPR compliance program in place, we can help maintain and update the system and identify areas for improvement via our health check service on a yearly basis. 
• Key staff training. We can help your team understand better the basics of the legislation, how it applies to your organisation and take practical steps to protect the organisation and themselves.
• DPO support or outsourcing. Where your organisation is obliged to appoint a DPO, we can help you outsource that obligation to our team of experts who will help design all the necessary reporting lines to enable a smooth operation and monitoring.