GDPR and UK GDPR
Data mapping, lawful basis, subject rights, transfer mechanisms and processor agreements, built as a working programme rather than a folder of policies.
Request a GDPR gap assessment- Frameworks
- ISO · NIST · NIS2 · GDPR · PDPL
- Output
- Audit-ready evidence
- Reporting
- Arabic and English
Why organisations get stuck
Compliance programmes stall when documents are written for auditors rather than for the people who have to follow them. Our GDPR and UK GDPR programme produces a management system your own teams can operate after we leave.
What the programme covers
Each area below is a defined part of the engagement, with an owner, an output and a date.
Data mapping
A record of what personal data you hold, where it flows and why.
Lawful basis
A defensible basis for each processing activity, recorded and reviewable.
Notices
Privacy notices and consent wording written for real use, in Arabic and English.
Data subject rights
Access, rectification and erasure handled within the statutory deadline.
Transfers
Transfer mechanisms and impact assessments for data leaving the UK or EEA.
Processor agreements
Article 28 terms with every processor, and evidence they are followed.
Breach notification
72-hour assessment and notification, rehearsed before it is needed.
Evidence
A maintained evidence set so the next assessment is not a scramble.
How the work runs
The same sequence on every engagement, so you know what happens next.
Assess
A gap assessment against the standard, showing what already passes as well as what does not.
Design
Scope, risk method, policy framework and control set agreed with your management team.
Implement
Documents written with the people who will follow them, and controls embedded in existing processes.
Audit
Internal audit and management review run properly, producing the records the certification body expects.
Sustain
Ongoing operation of the management system, or handover to your team with training.
What you get out of it
A system your team can run
Documents and processes written to be operated after we leave.
Audit-ready evidence
Evidence collected as work happens rather than assembled the week before the audit.
Bilingual delivery
Policies, training and reporting available in Arabic and English.
Before you enquire
How long does certification readiness take?
Can policies and reports be produced in Arabic?
Do you also perform the certification audit?
Where to go next
Request a GDPR gap assessment
One scoping call with the consultant who would run the work. No obligation, no charge.