Analyze
Data protection & digital compliance
What your site and systems actually collect, whether you are allowed to, and what to do about it: under the Data Protection Act 2019, which applies to public bodies and small firms alike.
Who this is for
You collect names, ID numbers and phone numbers because the form has always asked for them. Nobody has written down why, how long you keep them, or who can see them.
An organisation registering with the ODPC
The inventory and documentation the registration asks for, prepared properly.
A school or clinic
Children’s and patients’ data, where consent and retention are not optional.
A firm being audited by a client
The vendor security questionnaire answered once, with evidence behind each answer.
Anyone running a web form
A lawful basis, a privacy notice people can understand, and a retention rule that is actually applied.
What you get
A data inventory
What you hold, where it lives, who can reach it, and how long it stays.
A lawful basis for each purpose
Consent where consent is required, and something sturdier where it is not.
A privacy notice in plain language
Written to be read, not to be survived. Published and linked where the data is collected.
Consent and cookie handling
Implemented so it works, including the option of collecting nothing that needs a banner.
A retention schedule that runs
Deletion implemented in the system, not promised in a policy document.
ODPC registration support
The forms, the evidence and the follow-up, done with you.
How the build runs
Each stage ends with something you can open, and a decision you have to make. No month of silence.
- 011 week
Inventory
Every form, system and spreadsheet that holds personal data, listed.
- 021 week
Basis and gap review
Why you hold each item, and where that is not defensible.
- 031 week
Documentation
Privacy notice, retention schedule, access rules, breach procedure.
- 041–2 weeks
Implementation
The changes made in the systems, not just in the policy.
- 051 week
Registration and handover
ODPC registration support, and a review date in the diary.
What we need from you
Three things, and a project runs on time.
Most delays are not technical. They are a decision nobody was able to make, or data nobody could find.