Scope of compliance work

Read this before engaging us for a compliance audit, a DPIA or a compliance retainer. It exists so nobody is surprised later.

We are not your solicitor

We are not a law firm and we do not provide legal advice. Our compliance work is professional consultancy: we examine how your organisation actually handles data, document it in the structures the regulators expect, and tell you where the gaps are.

Where a question turns on the interpretation of law, we will say so and tell you to take legal advice. We would rather lose the fee than answer it.

We are not your Data Protection Officer

Unless separately engaged in writing to act as one, we do not hold the DPO role for you, and we do not carry the statutory independence that role requires.

What we produce, and who signs it

We draft assessments, records of processing and risk registers in the structure the Data Protection Commission expects, so that your DPO, your solicitor or your board can review and approve them.

We do not sign them off. A DPIA is your document and your decision. We do the work that makes it possible to sign; the signature stays with the person accountable for the processing.

What our findings mean

A finding that a gap exists is a professional opinion based on the information available to us at the time. It is not a guarantee that a regulator would reach the same view, and it is not a certification.

Equally, an audit that finds nothing serious is not a defence in itself. It means we found nothing serious in what we examined, on the day we examined it.

Your part

The work depends on what you tell us. If a system, a supplier or a data flow is not disclosed to us, it will not be in the assessment. Completeness is a shared responsibility, and the intake form exists to make that easier rather than to shift blame.

Liability

The liability cap in the terms of service applies to this work. Given what compliance findings are used for, we recommend you read that clause specifically rather than assume it.