OUR APPROACH
What we do, and where we start.
Every organization now runs on personal data, and everyone it deals with wants to know that data is in good hands. We work in four practice areas that together answer that question, and we offer them at three levels, depending on where you are today.
Four Practice Areas
01
02
03
04
Three Solutions
Foundational
Operational
Sustained
PRACTICE 02
Data Security and Incident Readiness
Know what to do, and know who to tell, when something goes wrong.
Incidents rarely look like the movies. A laptop is left in a car. An employee clicks a link. A spreadsheet goes to the wrong email address. A vendor calls to say their system was accessed.
What happens in the next few hours decides whether it stays a contained event or becomes a reportable breach, a client escalation and a news story. Organizations without a plan lose that time on basic questions. Who decides? Is this a breach under the law? Do we tell the NPC, and the people affected?
Under the NPC's breach management rules, the clock for a notifiable breach is 72 hours, and it starts when you know or reasonably believe a breach has happened. We help you answer those questions in advance, and when an incident does happen, we work beside you through assessment, notification and follow-up with the regulator.
We are privacy and governance advisers, and we work alongside your IT and security teams or providers. We do not replace them.
WHAT WE DO
Security measures
Your organizational, physical and technical safeguards against what the law and the NPC expect.
Incident log and annual report
A working register, and support filing your Annual Security Incident Report.
Incident response
A security incident policy and a named breach response team, with roles and decision points.
Vendor and processor risk
Review of security terms in your outsourcing and data sharing agreements.
Breach drills
Tabletop exercises that walk your team through a realistic scenario.
Board briefings
A clear account of your exposure and readiness for directors and management
Breach assessment and notification
Help deciding whether to notify, and preparing notices to the NPC and the people affected.
CALL US WHEN
-
You have no written plan for a data breach.
-
You are not sure which incidents must be reported.
-
You have never filed an Annual Security Incident Report.
-
Something has just happened and you need help now.
-
A vendor that holds your data has had an incident.
Not applicable? Click on these other practice areas:
OUR SOLUTIONS
Wherever you are on your compliance journey, we meet you there.
We build your foundation, equip your leaders and in-house teams, and stay as the rules evolve.
HOW WE ENGAGE
Three ways we work with you.
Fixed-scope Projects & Deliverables
We may be engaged to deliver a defined policy, audit report, review, or other documents at a fixed fee.
Retained Advisory & DPO Support
Ongoing access to our team as your outsourced or co-sourced Data Protection Officer, with regular reviews and regulatory updates.