Services
Risk Assessments
We provide a gap assessment and data mapping for businesses that hold personal data for themselves or for a customer. For example, clinics, insurance agencies, online retailers, payroll bureaus, and software and cloud providers. The assessment shows what personal data you hold, where it sits, which security level applies to it and what is missing, and ranks the gaps so you know what to deal with first. Before you launch a new system, product or AI tool, we also carry out a privacy impact assessment.
What gets examined
The assessment examines six areas, each against what the law and the regulations require.
A public-body customer
If you hold personal data on behalf of a public body — a government ministry, local authority, HMO, public hospital or higher-education institution — you must appoint a Privacy Protection Officer, whatever the scale.Sensitive data and monitoring
Whether your principal occupation involves processing specially sensitive data, or regular and systematic monitoring of people, at significant scale.Data classification
What in your systems may count as "specially sensitive" data, and where it sits.Your DPAs against reality
A gap between the contract and operational reality surfaces when a customer sends a questionnaire or when an incident occurs.Security level
Which security level applies to each database, by the type of data and the actual number of authorised users — suppliers and test-environment access included.Excess data
Old backups, CVs, exports and side files kept with no purpose.
Deliverables
At the end you receive a written picture of where you stand and the order in which to close the gaps, and for each new system, an impact assessment.
| Deliverable | What it contains |
|---|---|
| Applicability opinion | A detailed, comprehensive answer on whether the Privacy Protection Officer duty applies to you, on which ground, and what it requires of you. |
| Data map | Mapping of personal-data flows and identification of the databases. |
| Security level classification | The security level of each database, with the documented count of authorised users — the basis for every duty that follows from it. |
| Database definitions document | Delivered in a documentation pack, alongside a data security procedure, a record of processing activities and an external privacy notice. |
| Gap table | Assessment against the Privacy Protection Law and the Data Security Regulations — what is met, partly met, missing, or not yet verifiable — with a gap list ranked by exposure. |
| Privacy impact assessment (DPIA) | Before you launch a system, product or AI tool that processes personal data: what data it will collect, what risks that creates for the people it concerns, and which measures will reduce them. The GDPR requires one when processing is likely to be high-risk, and the Privacy Protection Authority’s draft guidance on AI recommends one before deployment. |
| Order of treatment | A handover session on the gaps, the order to address them and the effort each action takes, and one management briefing: what applies, what was decided, and what is minuted. |
How it runs
The work runs in five steps, and the scope is set in writing before it starts.
- Initial fit call
- A first discussion of the need, scope and priorities.
- Scope letter
- Deliverables, timetable and terms of engagement, in writing, before work starts.
- Collection
- A questionnaire and documents, then two to three conversations with the relevant people on your side.
- Delivery
- The deliverables, then a handover session on the gaps and the order to address them.
- Continuation, if you want it
- Ongoing support or filling the officer role.
- 1. Fit call
- 2. Scope letter
- 3. Collection
- 4. Delivery
- 5. Continuation
Questions people ask
What is the difference between this and a SOC 2 or ISO 27001 audit?
Those assess controls against a security framework. This assessment tests your organisation against the Privacy Protection Law and the Data Security Regulations, 2017: which databases exist, which security level applies, whether the officer duty applies, and whether your contracts match what actually happens to the data. It is legal work, and it produces a legal opinion.
How is “significant scale” decided?
Case by case. The Privacy Protection Law lists factors to weigh, among them the number of people, the volume and range of data, how long and how often it is processed, and how long it is kept. If you hold data for customers, the Privacy Protection Authority assesses scale cumulatively, across all of them — its guidance, not decided law. The questionnaire on this site cannot answer it; this service gives a reasoned written opinion on it.
What is a DPIA, and when do we need one?
A privacy impact assessment, written before a new system that processes personal data goes live: what the system collects, what risks it creates for the people the data is about, and which measures reduce them. The GDPR requires one when processing is likely to be high-risk, and the Privacy Protection Authority’s draft guidance on AI recommends one before deployment. We carry it out before launch, so the measures are built in from the start.