Privacy and compliance
Adequacy of controls, breach causation and regulatory reasonableness.
I have supported organisations through FCA, ISO and UK data protection compliance regimes, so I can assess whether systems and behaviours meet the required standards.
I give opinions on the adequacy of controls, breach causation, governance failings and the technical reasonableness of an organisation’s actions in regulatory contexts.
Questions I am asked to address
- Were the technical and organisational controls in place adequate?
- What caused the breach, and could it reasonably have been prevented?
- Were the organisation’s actions technically reasonable in the circumstances?
Example tools and platforms
- Regimes and standards
- UK GDPR and the Data Protection Act 2018
- California Consumer Privacy Act
- FCA cyber security and data protection requirements
- ISO 27001 and related ISO standards
- Hardware encryption standards
- Controls
- Microsoft Entra ID and conditional access
- Microsoft Intune device management
- Key and secret management
- Private networking and access control
- Consent management and cookie compliance
- Governance
- Compliance handbooks and policies
- Staff training and competency assessment
- Audit and accreditation readiness
- Data transfer and migration controls
Let's work together
Discuss an instruction
Send a short outline of the matter, the parties and any deadlines. I will run a conflict check and reply, usually within one working day.