Yes. We will assign a designated DPO to your organisation. 

Our service provides access to an experienced Data Protection Officer who has a full-time role in data protection and information security, undergoes regular CPD and is conversant with current best privacy practice.  

Collectively our team has every relevant data protection and information security certification, including CIPP/E, CIPP/A, CIPP/US, CIPM, CIPT, AIGP, FIP, CISSP, ISSMP and CISA. Our privacy and information security management framework is ISO27001 and ISO27701certified by BSI. We are corporate members of the International Association of Privacy Professionals. More importantly we have decades of collective experience in the management and governance of organisations, so we know how to put the theory into practice. 

We have clients across some 60 countries and offices covering multiple continents. Our specialist team has experience of working across diverse industries and geographies and has relevant data protection and information security certifications across these markets.  

We charge an annual subscription fee. This is paid monthly and is based on a number of factors including the size of your organisation, the type of processing it conducts, and whether you already operate in a regulated environment. Nearly all our DPO engagements are for a fixed fee rather than hours per month, so your organisation can know you are covered. 

All annual subscriptions for DPO as a Service include a level of coverage for DSARs or other rights requests. As each organisation has a different expected number of rights requests each year, we will work with you to estimate the coverage you need as part of your contract with us.    

We will help ensure your organisation has a data breach response procedure, coordinated with various operational and risk responses your organisation may already have. Step 1 of any data breach is to inform us as the DPO, and we will handle incident response in keeping with established response protocols. 

This will vary by jurisdiction. Some countries require all data breaches be reported by law, but the Regulator guidance narrows down mandatory reporting to cyber incidents and large scale data breaches. In other jurisdictions, the number of impacted individuals sets data breach reporting thresholds, while in Europe generally if a breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, you must inform those individuals. 

Yes. We deliver CPD focused on data protection and cyber security, tailored to particular audiences as part of our ongoing relationship. This would typically be general staff awareness training. 

We can also provide specialist training support and consultancy advice such as working with specific teams or running more focused data protection workshops for teams planning the deployment of new technology, for example or an AI tool. 

You can call us at any time. We provide advice on all aspects of data protection compliance and governance. Our experts will answer questions, advise on tricky issues and provide support in dealing with regulators, partners and data subjects where this is not handled by the DPO service. 

All our DPO engagements operate with strict information barriers, meaning each client’s information is protected and segregated using access controls and other technical measures to ensure only the DPO and their team can have access to your organisations data. 

While each organisation is different, a common theme is a dependence on third-party providers.  Ensuring appropriate vendor and third-party providers undergo data protection due diligence is key to reducing your organisation’s privacy risk.  Securys has experience  setting up vendor management processes for medium and enterprise organisations in order to help manage their data protection third-party risks.