Phase 2 · Strategy & Planning · From Idea to Executable Plan
Data Protection & GDPR Programme
Every business holds personal data. Every business that holds personal data has GDPR obligations. Most businesses meet some of those obligations by accident and miss others entirely.
Data protection and GDPR programme is the structured implementation of the data protection obligations that apply to the business under UK GDPR and related legislation — from the data audit and privacy notice through the data processing agreements, the subject access request process, and the breach response plan. We implement the programme that ensures the business meets its legal obligations, protects its clients' data, and avoids the fines, reputational damage, and contractual breaches that data protection failures create.
The Pain We Solve
You may recognise yourself in one of these.
Three audience scenarios · because the same service produces a different transformation depending on where you are in the business journey.
Scenario 1
The business that holds customer data and has never conducted a GDPR audit or implemented a privacy framework
The business collects names, email addresses, and other personal data. It has a privacy policy on the website. And beyond that, the compliance framework does not exist — there is no data mapping, no legitimate basis documented, no breach response plan, and no data retention policy.
Scenario 2
The business that has received a data subject access request and does not know what it is required to do
An individual has requested a copy of all the data the business holds on them. The business has 30 days to respond. It does not know which systems hold data about this individual, what format to provide it in, or what it is entitled to withhold. The process has never been designed.
Scenario 3
The business working with enterprise clients that has received a GDPR questionnaire it cannot complete accurately
The client's supplier qualification process includes a data protection questionnaire. The questions require evidence of data mapping, processing agreements, security controls, and breach response procedures. Most of the answers are that the procedures do not exist.
The Impact It Creates
The Moment You Will Feel the Difference.
GDPR compliance implemented — data mapped, bases documented, notices updated, and controls in place
Client data protection trust built through demonstrable compliance
Enterprise supplier GDPR qualification requirements met
Breach response plan in place so a data incident is managed rather than catastrophic
What You Receive
The Specific Deliverables.
Tangible outputs · documented, dated, and yours to keep.
- Data mapping and Records of Processing Activities (RoPA)
- Lawful basis documentation and privacy notices
- Data processing agreements with suppliers and processors
- Subject access request process design
- Data breach response plan
- GDPR staff training programme
The Outcome
Where You Will Be on the Other Side.
The business meets its GDPR obligations consistently — with the data mapping, the policies, the processes, and the staff awareness that make compliance genuine rather than theoretical and that protect clients' data as they have a right to expect.
Primary Focus
Implementing a comprehensive GDPR and data protection programme that meets legal obligations and protects client data through documented processes and controls.
KPI Measurement
- Data mapping completeness
- GDPR questionnaire pass rate
- Subject access request response compliance
- Data breach incidents and response time
- Staff GDPR awareness score
Investment & ROI
Pricing Engineered Around the Value You Create.
Every engagement is sized against the value we believe we can create with you · the fee is always a fraction of the outcome. Four tiers · so the investment matches your stage of business.
Tier 1
Foundations
£5,000 – £15,000
Right for
Pre-startup, startup, and micro-business founders ready to build on evidence rather than instinct.
Typical Value Created
£100K+ in sharper resource allocation and avoided strategic missteps
Engagement
4 – 8 weeks
Target Return
5 – 10× ROI
within 12 – 18 months
Tier 2
Acceleration
£15,000 – £50,000
Right for
Growing SMEs and established small businesses ready to scale a working model into the next revenue band.
Typical Value Created
£500K – £3M in faster execution and pipeline acceleration
Engagement
8 – 16 weeks
Target Return
5 – 10× ROI
within 12 – 18 months
Tier 3
Transformation
£50,000 – £250,000
Right for
Medium enterprises and scale-stage businesses ready to commit to a multi-quarter, organisation-wide shift.
Typical Value Created
£2M – £20M in strategic value through repositioning, model redesign, and growth-system installation
Engagement
3 – 9 months
Target Return
5 – 10× ROI
within 12 – 18 months
Tier 4
Enterprise
£250,000 – £2M+
Right for
Large enterprises, global operators, and complex organisations ready for a multi-year strategic partnership.
Typical Value Created
£10M+ in major strategic initiatives, capital deployment efficiency, and competitive repositioning
Engagement
12 months and onward
Target Return
5 – 10× ROI
within 12 – 18 months
Why We Price This Way
Every engagement is sized around the value we believe we can create with you. The fee is always a fraction of the outcome · typically 10 – 20% of the expected first-year return.
This is how we make sure pricing aligns with results. The conversation is never “what does this cost?” · it is always “what is this worth to your business?” We answer that together in the first call, transparently, and decide the right tier from there.
If we cannot articulate a credible 5–10× return for your specific situation, we will tell you in the first call. That honesty is part of why our clients trust us with the work that matters most.
Why This Conversation Matters
“GDPR compliance is not about avoiding the fine. It is about treating people's data with the respect they are entitled to by law — and building the trust with clients and partners that genuine data protection creates. We implement the programme that achieves both.”
A 90-minute structured strategy session · produces a usable roadmap whether you engage further or not.
More in Phase 2