Governance · 02 · Privacy and data governance
Personal data handled the way the law and your clients expect.
Medical, legal, financial and professional practices hold data that regulators protect and clients assume is safe. We map what is held, align it to the rules that apply, build the controls that make policy real, and prepare the evidence.
What we do
From data map to evidence pack.
- Data inventory and flow mapping across systems and vendors
- HIPAA, GDPR, CCPA and sector readiness with gap assessment
- Data protection impact assessments for new systems and uses
- Retention, deletion and access controls that can be demonstrated
- Vendor data agreements, business associate agreements and transfer reviews
- Audit preparation and evidence packs
Why it belongs with security
One evidence base.
A privacy program without technical controls is a policy document. A security program without a data inventory protects the wrong things. We run both from the same evidence base.
Capabilities
What it covers.
Data inventory and mapping
Data inventory and mapping establishes what personal and sensitive data the organization holds, where it comes from, where it is stored, who can access it, where it is sent, how long it is kept and under what legal basis.
Learn more →02 / CapabilityHIPAA readiness
HIPAA readiness prepares a covered entity or business associate to meet the Privacy, Security and Breach Notification Rules: the risk analysis the Security Rule requires, the administrative, physical and technical safeguards, the policies and workforce training, the business associate agreements, and the evidence that would be examined in an investigation or audit.
Learn more →03 / CapabilityGDPR and CCPA readiness
GDPR and CCPA readiness prepares an organization to meet the obligations of the European and California privacy regimes, and the state laws modeled on them, that apply to the personal data it holds: lawful bases and notices, individual rights handling, records of processing, data protection assessments, vendor contracts, cross-border transfers and breach notification.
Learn more →04 / CapabilityData protection impact assessments
A data protection impact assessment examines a new or changed system, process or use of personal data before it goes live, to identify the risks to the individuals concerned and the measures that reduce them, and to record the decision.
Learn more →05 / CapabilityRetention and deletion controls
Retention and deletion controls turn a retention policy into something that actually happens: schedules per data category, the technical means to delete or anonymize data when its period ends, the handling of legal holds, backups and vendor copies, and the evidence that deletion occurred.
Learn more →06 / CapabilityVendor data agreements and transfer review
Vendor data agreements and transfer review examines every vendor that processes personal data on the organization’s behalf to confirm the required agreements are in place, the terms meet the applicable law, the data is protected as promised, and any transfer across borders has a lawful mechanism.
Learn more →07 / CapabilityPrivacy evidence and audit preparation
Privacy evidence and audit preparation assembles and verifies the records that demonstrate a privacy program operates: the inventory, notices, procedures, assessments, agreements, training, request handling and breach records, organized for the regulator, customer, auditor or certification body that will examine them.
Learn more →Observe
Understand the environment, the risks, the obligations, and the operational constraints.Fortify
Strengthen practical safeguards without disrupting essential workflows.Verify
Test whether controls perform as intended.Evidence
Document the results clearly for leadership, auditors, clients, and partners.Sustain
Keep controls operating through reporting, review, remediation, and continuous improvement.