ASSESSMENT
Know what applies. Know what needs attention.
A scoped assessment reviews the agreed evidence, identifies applicable work and produces prioritised findings and an action plan.
The output: a clear order of work for your organisation.
MANAGED NDPA COMPLIANCE
We build, fix and run your NDPA compliance programme.
From assessment and staff training to remediation, evidence, audit and applicable filing, Blaecwood manages the agreed programme with your team.
Licensed Data Protection Compliance Organisation. NDPC/DPCO/17469.
Clear priorities. Coordinated work.
Evidence you can use.
- Businesses Served
- 111
- Currently Serving
- 7
One managed programme: assessment, training, remediation, evidence, audit, applicable filing and ongoing support.
WHY A MANAGED PROGRAMME
A gap report is not a compliance programme.
Policies, records, vendor arrangements, impact assessments, training and day-to-day processes need coordinated execution. We turn the agreed priorities into work with your team, then organise the evidence behind it.
Explore the managed programmeHOW THE PROGRAMME WORKS
Seven stages. One coordinated programme.
-
01
Assess
Understand your environment and agree priorities.
-
02
Build
Put the privacy framework and working records in place.
-
03
Fix
Address the agreed governance, process and control gaps.
-
04
Operate
Train your people and support day-to-day responsibilities.
-
05
Evidence
Organise records that show what is in place.
-
06
Audit & File
Complete separately controlled assurance and applicable filing.
-
07
Maintain
Keep the programme current as your organisation changes.
TRAINING
Help your people put privacy into practice.
Practical training for relevant leadership, employees and privacy champions, with agreed learning outcomes and attendance or completion records.
The output: people who understand their responsibilities, with records of the learning delivered.
WHAT WE HANDLE
The work, in six parts.
Assess and plan
Determine what applies, review the current environment and prioritise the work.
Scope examples
DCPMI and registration assessment, data mapping, processing records (ROPA), gap assessment and the need for data protection or legitimate interests assessments (DPIA/LIA).
Build the privacy framework
Create or correct the records, notices, procedures and governance your organisation needs.
Scope examples
Privacy notices, lawful-basis records, retention, rights handling, breach procedures and governance records.
Train and operate
Train leadership and staff, then support ongoing compliance operations.
Scope examples
Role-based training, completion records, DPO-function support where applicable, reporting and monitoring.
Manage vendors and data flows
Review vendors, processors, data-sharing arrangements and transfer controls.
Scope examples
Data processing agreements, processor reviews, cross-border assessments and data-sharing controls.
Fix and evidence
Address ordinary governance, documentation, process and control gaps and organise evidence.
Scope examples
Remediation actions, implementation records and an evidence register. Heavy engineering, specialist security, incident response and specialist legal work are separately scoped.
Audit and maintain
Complete separately controlled licensed DPCO assurance, applicable filing and ongoing maintenance.
Scope examples
Formal audit, DPCO verification and attestation, CAR preparation and submission, maintenance and periodic review.
TWO BUYING ROUTES
Start with the work you need.
RESPONSIBILITY AND ASSURANCE
Agreed work. Clear responsibilities.
Working with your team
Blaecwood manages the agreed programme with the client team. DPO-function support may be included where applicable. Formal appointment as your named outsourced DPO is separately approved and contracted.
Separately controlled assurance
Statutory audit and DPCO verification are separately assigned, conflict-checked and quality-reviewed. Assurance responsibilities remain separate from programme implementation and any formal DPO appointment.
START HERE
Start with your organisation. We will map the work.
Share your organisation, need and timing. Submit the short request or continue with more detail when you have it.