Where your privacy programme stands today, assessed purely at the organisational level — governance, ownership, and cross-cutting practice, not a re-run of DPIA's per-application depth. A bundle of org-wide checks, some covered in real depth and others as a pointer toward the service that goes deeper.
Every item below stays at the organisational level. Per-application or per-processing-activity depth belongs to DPIA, not here.
Whether privacy decisions have a clear, accountable owner across the organisation, not just a name on an org chart.
How notices and consent practices are structured as policy across the org — not application by application.
Whether the organisation has a working, current sense of what data it holds and where — a programme-level fact, not a full register build.
Whether an org-wide practice for managing processor relationships exists at all — full clause-level depth sits with Vendor Agreement Review.
Whether Data Principal requests — access, correction, erasure — have a working operational path today, organisation-wide.
How much of the organisation has actually been reached by privacy training, as a coverage metric — not a review of training content.
Whether an incident-response capability exists at the organisational level — full tabletop depth sits with Breach Readiness Assessment.
Whether a retention/disposal policy exists and is applied consistently across the organisation, not system by system.
Where a surface-level finding warrants a full dive, the report says exactly which service to go to next.
Org-level only — no per-application depth happens here.
Understand current ownership, policies, and practices as they actually operate.
Organisational level only — scoped to programme-wide ownership and structure, not individual systems.
Test each org-level area — some in real depth, some as a lighter surface pass.
Against the real user-facing experience where relevant, not just internal documents.
Score each area, and flag which surface-level findings warrant a deeper service.
The routing step — light-touch findings here become an explicit pointer to Vendor Agreement Review, Breach Readiness Assessment, or wherever depth is actually needed.
Walk through findings and sequence what to build first.
Framed for leadership sign-off and resourcing decisions, not just a findings list.
30 minutes to talk through scope, no obligation.
Book a Consultation