Visibility That Supports Decisions
Understand personal data, processing purposes and dependencies across your organisation.
Data privacy & protection
Know your data.
Build privacy into delivery.
Protect trust as you grow.
Connect privacy governance with the way your organisation collects, uses, shares and protects personal data. Cyber360 helps you assess maturity, prioritise risks and build practical privacy controls across the data lifecycle.
Privacy & data protection • Practical controls. Clear accountability.
Understand → Improve → Validate
From questions to decisions
A privacy programme built around your business.
Multiple laws, complex suppliers and changing technologies can leave privacy work fragmented. We help create a shared view of your obligations, data flows and operational priorities, then turn that view into a programme your teams can use.
Controls That Fit Operations
Embed privacy into products, procurement and everyday workflows with clear responsibilities.
A Foundation for Change
Develop governance, evidence and review processes that can adapt to new initiatives and jurisdictions.
When it adds value
Focus effort where it can make a difference.
Starting or Resetting a Programme
Establish a maturity baseline, ownership and a practical roadmap for improvement.
Operating Across Jurisdictions
Identify relevant privacy regimes and separate common controls from local requirements.
Launching Products or Using New Technology
Bring privacy risk assessment into analytics, AI, digital services and design decisions.
Managing Fragmented Processes
Connect rights requests, preferences, suppliers, transfers and incident readiness into coherent operations.
Service areas
Privacy translated into practical action.
These are examples for scoping, not an all-inclusive package. Technologies, delivery expertise, access requirements and outputs are confirmed before an engagement.
01
Maturity, Obligations & Governance
What should the programme focus on?
- Example scope
- Agreed entities, markets, processing activities, policies, responsibilities and oversight arrangements.
- What we examine
- Privacy maturity, relevant legal requirements, evidence gaps and business priorities.
- Evidence to take away
- A maturity assessment, applicability matrix and prioritised programme roadmap.
02
Data Lifecycle & Information Protection
Where does personal data travel and how is it protected?
- Example scope
- Collection, processing, storage, sharing, retention, deletion and associated systems.
- What we examine
- Purposes, access, minimisation, safeguards, ownership and data-flow dependencies.
- Evidence to take away
- An enterprise data inventory, processing maps and control improvement actions.
03
Privacy by Design & Impact Assessment
Are risks considered before delivery?
- Example scope
- Selected products, projects, analytics or AI use cases, design gates and change processes.
- What we examine
- Risks to individuals, assessment triggers, mitigation options and approval responsibilities.
- Evidence to take away
- Impact-assessment tools, privacy engineering guidance and design checkpoints.
04
Rights, Consent & Preferences
Can individuals understand and control relevant uses?
- Example scope
- Notices, rights intake, request fulfilment, consent where appropriate and preference changes.
- What we examine
- Verification, exceptions, response tracking, withdrawal and the link to operational systems.
- Evidence to take away
- Rights-management workflows, notice actions and consent or preference requirements.
05
Suppliers & International Data Flows
Are external dependencies understood?
- Example scope
- Vendors, processing arrangements, contractual safeguards, data locations and international sharing.
- What we examine
- Due diligence, transfer requirements, assessments and ongoing oversight.
- Evidence to take away
- Supplier privacy toolkit, transfer review actions and accountability records.
06
People, Incident Readiness & Improvement
Can the programme operate consistently?
- Example scope
- Role-based awareness, incident escalation, investigation, notification decisions and programme reporting.
- What we examine
- Responsibilities, response exercises, evidence maintenance and change-triggered reviews.
- Evidence to take away
- Training materials, incident playbook and ongoing review calendar.
How it works
From understanding to everyday accountability.
- 01
Agree the Context
Define business priorities, jurisdictions, processing scope and stakeholders.
- 02
Map and Assess
Discover personal data flows and review maturity, safeguards and operational evidence.
- 03
Prioritise the Response
Set actions around risks to individuals, obligations, business impact and dependencies.
- 04
Build the Programme
Develop agreed governance, documentation, workflows and design guidance.
- 05
Enable the Teams
Assign ownership, deliver awareness and walk through key operating processes.
- 06
Review and Adapt
Measure progress, maintain evidence and reassess following material change.
What you receive
Clear enough to decide.
Detailed enough to act.
The reporting package is agreed around your audience and the decisions it needs to support.
For Leadership & Programme Owners
- Privacy maturity and gap assessment with a phased roadmap.
- Jurisdiction and requirement applicability matrix.
- Governance model, responsibilities and reporting priorities.
- Review calendar and role-based awareness programme.
For Operational & Delivery Teams
- Data inventory and lifecycle processing maps.
- Tailored policy, notice and rights-management materials.
- Impact-assessment and privacy-by-design toolkit.
- Supplier, transfer and incident-readiness procedures.
Meaningful progress
Track the improvement.
Keep the evidence.
Agree what completion means for each action: an approved design decision, a reviewed configuration, a resolved finding or a demonstrated process. Record owners, dependencies, exceptions and the evidence available.
Keep records, notices and risk decisions current. Review the programme when purposes, technologies, suppliers or jurisdictions change.
Preparing the engagement
Start with the right context.
01
Business & Jurisdiction
- Identify operating entities, markets and relevant regulatory concerns.
- Confirm controller or processor roles and existing privacy ownership.
02
Data & Evidence
- Share processing records, notices, retention schedules and system diagrams.
- Provide supplier lists, contracts and known cross-border data flows.
03
People & Priorities
- Nominate privacy, legal, IT, HR, marketing and procurement contacts.
- Share open risks, previous incidents and upcoming projects.
04
Delivery & Decisions
- Agree work packages, access, responsibilities and approval routes.
- Confirm when specialist legal review or system implementation is required.
Reference guidance: NIST Privacy Framework. Relevant practices are selected for the agreed scope; applicability and evidence boundaries are agreed during scoping.
Clear boundaries
Know what the work establishes.
The engagement supports agreed activities, jurisdictions and evidence. Your organisation retains responsibility for processing decisions, legal obligations and control operation. Specialist legal opinions, formal audits, regulator representation and production implementation require explicit agreement.
GDPR Compliance
Explore focused support for EU GDPR obligations.
Explore the service →CCPA / CPRA Compliance
Address California consumer privacy requirements.
Explore the service →Defensive Security
Connect privacy priorities with security architecture and controls.
Explore the service →Practical questions
Before we get started.
Is this focused on one privacy law?
No. The programme begins with your processing activities and relevant jurisdictions. Specific legal regimes and deliverables are agreed at scoping; common controls do not remove local obligations.
How is privacy different from cybersecurity?
Cybersecurity protects information and systems. Privacy also considers why personal data is used, how it affects individuals and whether practices are appropriate. The two disciplines work together.
Can you support a new AI or analytics initiative?
Yes. Agreed work can include data flows, assessment triggers, minimisation, safeguards and approval gates. Specialist legal opinions or technology implementation need a defined work package.
Will you install a privacy platform?
Tool requirements and integration guidance can be included. Procurement, configuration, automation and production deployment are only included when explicitly agreed.
Can we reuse GDPR documentation?
Yes, where useful. We review its fit for current processing and other applicable regimes, then identify gaps rather than assuming one set of documents covers everything.
Will this certify our organisation?
No. This is advisory and implementation support for an agreed scope. It does not guarantee compliance or provide regulatory approval; ongoing decisions and control operation remain your responsibility.
Take a closer look
The service overview,
ready to share.
Download the Cyber360 Data Privacy & Protection brochure for the service scope, engagement approach, deliverables and preparation guidance.
PDF · 4 pages · 520 KB
Your next step
Where does your privacy programme need a clearer direction?
Tell us the decision you need to make. We’ll help define a useful scope.