Programme design
A privacy programme starts with what you process.
Most organisations can produce a privacy policy. Fewer can say, with confidence, what personal information they collect, why, where it sits, who else sees it, and how long it is kept.
That gap is not academic. Notices, operator contracts, retention rules and training only work if they describe the processing that actually happens — in HR, finance, sales, operations, marketing, clinical or student systems, and the suppliers attached to each.
A programme that starts with the documents will always drift from the operation. A programme that starts with the processing can be defended to a board, a tender panel or the Regulator.
That is the first piece of work we do with a new client. Everything else is built on it.