KYData Privacy
An independent view of how your privacy programme holds up in practice.
When privacy goes wrong, it goes wrong fast, and the pressure hits from every angle:
- A regulatory investigation testing your compliance under scrutiny.
- A major customer conducting deep commercial due diligence.
- A data breach escalating from a technical issue into a boardroom crisis.
- An investor asking hard questions you cannot answer with confidence.
These are not hypothetical risks, but the moments that expose the gap between a programme on paper and one that holds up in reality.
Our audits draw on first-hand experience of major incidents and near-misses, board-level leadership, and insider knowledge of where real compliance gaps sit; with our regulatory and governance golden thread running through every finding.
Does any of this sound familiar?
>You have had an incident, or a near-miss, and you are not confident you fully understand your exposure.
>You are growing fast, entering new markets, or launching new products, and privacy has not kept pace.
>You have legacy systems where nobody has a clear picture of what data sits where or what controls actually apply.
>A regulator, auditor, major customer, or investor has asked questions you could not answer with complete confidence.
What KYData Privacy covers
We assess how your privacy programme holds up against the regulatory frameworks that apply to you, tailored to your jurisdictions, sector, and risk profile:
- Governance and accountability: Evaluating your privacy frameworks, oversight structures, and lines of responsibility.
- Lawful basis and consent: Scrutinising your legal grounds for processing and how consent is captured, managed, and evidenced.
- Purpose limitation and retention: Testing whether data is used strictly as intended and deleted on schedule in practice.
- Data subject rights: Reviewing how efficiently and accurately your teams handle access, deletion, and objection requests.
- Cross-border transfer mechanisms: Assessing international data transfer safeguards, transfer risk assessments, and vendor agreements.
- International regulatory readiness: Multi-jurisdictional coverage across EU GDPR, UK GDPR, the Data (Use and Access) Act 2025, CCPA/CPRA, LGPD, PIPL, and other applicable laws.
Where data flows are central to the picture, KYData Governance provides the foundation, and can be commissioned before or alongside KYData Privacy for a joined-up view. Cookies and tracking on your website are covered by our KYCookies Web Compliance Audit.
How it works
KYData Privacy is one of three KYData (Know Your Data) modules, alongside KYData Governance and KYData Cyber Governance. Privacy, data governance and cyber do not sit in neat silos, and neither do the issues organisations face.
Commission KYData Privacy on its own, or combine it with one or both of the other modules. Where you commission multiple modules, each runs as its own workstream, giving you genuine depth in each area, brought together at the end.
Where documentation is limited or incomplete, structured interviews will be needed; in which case an Assessment is the right starting point rather than a Snapshot. We advise before we begin.
Tiers & delivery
| Tier | What it involves | Delivered as |
|---|---|---|
| Snapshot | Rapid review of key documentation: policies, notices, consent mechanisms, and governance structures. | Findings summary with prioritised recommendations. |
| Assessment | Document review plus structured interviews. A fuller picture of how privacy operates in practice across legal, compliance, technology, and the business. | Report with findings and recommendations, presented to leadership. |
| Extended review | Broader scope: suited to post-incident situations, regulatory preparation, or where privacy intersects with data governance and cyber. Can be mobilised quickly where urgency requires. | Detailed findings report and prioritised remediation recommendations, presented to leadership. |
| Deep dive | Comprehensive review across documentation, interviews, and full analysis. For organisations preparing for a regulatory moment, major transaction, or serious programme rebuild. | Comprehensive report with risk assessment and remediation roadmap, presented to leadership. A Deep dive is also required where we will act as your named DPO. |
On concluding, you will know exactly where you stand; what the real risks are, what matters most, and what to do about it. Whether you are preparing for scrutiny, dealing with the aftermath of an incident, or simply want to get ahead of a challenge before it finds you, you will have an honest picture and a clear path forward.
Read our latest on privacy and data >