Clarity Across Your Data
Understand processing purposes, ownership, sharing and retention so decisions rest on an informed view.
GDPR compliance
Know your data.
Earn greater trust.
Put privacy into practice.
Turn privacy obligations into clear responsibilities, practical controls and evidence of progress. Cyber360 helps you map personal data, address compliance gaps and build a privacy programme that supports your business.
UK & Middle East • Practical privacy. Clear accountability.
Understand → Improve → Validate
From questions to decisions
Make privacy part of how your business works.
A policy alone cannot tell you where personal data travels, who can access it or how a rights request will be handled. We connect governance with everyday operations, helping your teams make better decisions about the information entrusted to them.
Trust Built Into Delivery
Bring privacy considerations into products, supplier relationships and customer interactions from the outset.
A Programme You Can Sustain
Translate findings into accountable actions, workable procedures and evidence that stays current.
When it adds value
Focus effort where it can make a difference.
Entering or Serving European Markets
Clarify the relevance of EU GDPR to your establishment, offering of goods or services, and monitoring activities.
Changing How Data Is Used
Assess a new product, technology, supplier or business process before privacy risks become harder to address.
Unclear Ownership or Documentation
Bring processing records, lawful-basis decisions, notices and retention practices into a coherent programme.
Responding Under Pressure
Prepare teams to handle rights requests and personal data breaches with clear escalation and decision records.
Service areas
Privacy across the data lifecycle.
These are examples for scoping, not an all-inclusive package. Technologies, delivery expertise, access requirements and outputs are confirmed before an engagement.
01
Data Mapping & Processing Records
Do you know where personal data goes?
- Example scope
- Agreed business units, systems, processing purposes, data categories, recipients, retention and transfers.
- What we examine
- Data flows, controller and processor roles, lawful-basis decisions and applicable Article 30 record requirements.
- Evidence to take away
- A processing inventory and records-of-processing framework with ownership and update responsibilities.
02
Gap Assessment & Governance
Which gaps matter, and who owns the response?
- Example scope
- Privacy policies, notices, accountability arrangements, training and selected technical and organisational measures.
- What we examine
- Evidence against applicable requirements, DPO and representative needs, and practical remediation dependencies.
- Evidence to take away
- A gap report, prioritised roadmap and tailored privacy documentation suite.
03
Individual Rights & Transparency
Can people understand and exercise their rights?
- Example scope
- Request intake, identity checks, search and review workflows, response templates and relevant privacy notices.
- What we examine
- Access, rectification, erasure, restriction, portability and objection handling, including applicable conditions and exceptions.
- Evidence to take away
- A rights-request workflow, tracking register and clear responsibilities for timely responses.
04
DPIAs & Privacy by Design
Are privacy risks considered before change?
- Example scope
- Proposed processing, project approval gates, data minimisation, retention and protection measures.
- What we examine
- DPIA screening, risks to individuals, mitigation options and escalation of unresolved high risks.
- Evidence to take away
- DPIA templates, assessment guidance and privacy checkpoints for design and delivery.
05
Suppliers & International Transfers
Are responsibilities clear beyond your organisation?
- Example scope
- Processors, subprocessors, contractual arrangements, data locations and cross-border processing flows.
- What we examine
- Due diligence, processing agreement requirements and applicable transfer mechanisms and assessments.
- Evidence to take away
- A processor oversight toolkit, contract review actions and a transfer assessment record where agreed.
06
Breach Readiness & Ongoing Assurance
Can your team act quickly and keep improving?
- Example scope
- Breach identification, escalation, investigation, risk assessment, notification decisions and review cycles.
- What we examine
- Controller and processor duties, records, staff awareness and maintenance of programme evidence.
- Evidence to take away
- A breach-response playbook, decision templates, training materials and compliance review calendar.
How it works
From discovery to everyday accountability.
- 01
Define the Context
Agree jurisdictions, business activities, stakeholders and the personal-data processing to be reviewed.
- 02
Discover the Data
Map processing, systems, suppliers, purposes and data flows with accountable business owners.
- 03
Assess and Prioritise
Review evidence against applicable obligations and prioritise gaps by risk to individuals and delivery impact.
- 04
Build Practical Controls
Develop agreed documentation, workflows, DPIA tools and supplier or rights-management procedures.
- 05
Prepare Your People
Assign responsibilities, deliver role-based awareness and walk through key response scenarios.
- 06
Sustain the Programme
Set review dates, evidence ownership and change triggers so privacy keeps pace with the business.
What you receive
Clear enough to decide.
Detailed enough to act.
The reporting package is agreed around your audience and the decisions it needs to support.
For Leadership & Privacy Owners
- A gap assessment and risk-prioritised implementation roadmap.
- Processing inventory and records-of-processing framework.
- Governance responsibilities and tailored policy and notice actions.
- A review calendar and role-based awareness materials.
For Operational & Delivery Teams
- Rights-request workflows, templates and a tracking register.
- DPIA screening and assessment tools with mitigation records.
- Processor oversight and international-transfer review actions.
- Breach escalation, risk assessment and notification decision templates.
Meaningful progress
Track the improvement.
Keep the evidence.
Agree what completion means for each action: an approved design decision, a reviewed configuration, a resolved finding or a demonstrated process. Record owners, dependencies, exceptions and the evidence available.
Keep processing records, notices and risk decisions current. Review the programme when purposes, systems, suppliers or jurisdictions change.
Preparing the engagement
Start with the right context.
01
Business & Jurisdiction
- Identify operating entities, markets and relevant regulatory concerns.
- Confirm controller or processor roles and existing privacy ownership.
02
Data & Evidence
- Share processing records, notices, retention schedules and system diagrams.
- Provide supplier lists, contracts and known cross-border data flows.
03
People & Priorities
- Nominate privacy, legal, IT, HR, marketing and procurement contacts.
- Share open risks, previous incidents and upcoming projects.
04
Delivery & Decisions
- Agree work packages, access, responsibilities and approval routes.
- Confirm when specialist legal review or system implementation is required.
Reference guidance: EDPB: GDPR data protection guidance. Relevant practices are selected for the agreed scope; applicability and jurisdiction-specific obligations are confirmed during scoping.
Clear boundaries
Know what the work establishes.
The engagement supports the agreed processing activities and jurisdictions. Your organisation retains responsibility for processing decisions, legal obligations and operating the controls. Specialist legal opinions, DPO appointments, regulator representation and system implementation require explicit agreement.
PCI DSS Compliance
Strengthen payment security and prepare for the appropriate validation route.
Explore the service →ISO 27001
Connect privacy governance with a wider information security management system.
Explore the service →Defensive Security
Review the risk, architecture and controls protecting your information.
Explore the service →Practical questions
Before we get started.
Does EU GDPR apply to a business outside the EU?
It can. Relevant factors include an EEA establishment, offering goods or services to people in the EEA, or monitoring their behaviour there. Application depends on the processing and role; it is not determined simply by citizenship or having an EU customer.
Does this also cover UK GDPR?
EU GDPR and UK data protection law are separate regimes. We confirm the jurisdictions and applicable requirements at scoping. UK-specific work is agreed expressly, taking account of current UK legislation and ICO guidance.
Must every breach be reported within 72 hours?
No. Controllers must assess the risk and notify a reportable breach without undue delay and, where feasible, within 72 hours of awareness. High-risk breaches may also require notification to individuals without undue delay. Processors notify the controller without undue delay; all breaches need appropriate records.
Do we always need a DPO or a DPIA?
No. Appointment and assessment duties depend on the applicable criteria and processing. We help assess the relevant requirements; a DPIA is required where processing is likely to create a high risk to individuals.
Will this certify us or guarantee compliance?
This service supports assessment, implementation and ongoing accountability. It does not provide regulatory approval, guarantee compliance or remove your responsibilities. Specialist legal advice and independent certification, if relevant, require separate agreement.
Can this help with other privacy laws?
Processing records, governance and controls can provide a useful foundation. Compliance with GDPR does not establish compliance with UAE PDPL, CCPA or other laws; each regime requires a separate applicability and gap assessment.
Take a closer look
The service overview,
ready to share.
Download the Cyber360 GDPR Compliance brochure for the service scope, engagement approach, deliverables and preparation guidance.
PDF · 4 pages · 520 KB
Your next step
Where does your privacy programme need to work harder?
Tell us the decision you need to make. We’ll help define a useful scope.