Privacy breaks where policy meets actual data use.
A privacy program can have polished notices and still fail in the workflows underneath them. We follow personal data through products, vendors, marketing, HR, customer operations, and AI use to find where obligations, ownership, and operating reality have drifted apart.
Privacy obligations live across the data lifecycle.
Collect
Sources, categories, people, channels, notice, consent.
Use
Purpose, product behavior, analytics, operations, marketing.
Share
Processors, partners, advertising, transfers, downstream use.
Infer / AI
Model use, profiling, inference, new purpose, outputs.
Retain
Business need, legal requirement, backup, archive, deletion constraints.
Rights / Delete
Verification, preferences, fulfillment, system reach, proof.
No single team owns the whole data story.
Privacy fails in the handoffs between functions as often as it fails inside any one function.
Product & Engineering
Features, telemetry, integrations, data architecture, AI, purpose changes.
Marketing & Sales
Advertising, analytics, lead data, consent, preferences, representations.
Legal & Privacy
Notices, rights, contracts, transfers, assessments, governance.
Security
Access, incidents, vendors, protection, logging, retention dependencies.
HR
Workforce data, recruiting, benefits, monitoring, retention.
Operations & Vendors
Processors, support workflows, data movement, deletion, subprocessors.
Move from privacy documents to privacy decisions.
Why is the data being processed, and did the use change after collection?
Do notices, consent, and customer representations match the actual workflow?
Who receives data, under what role, for what purpose, with what downstream use or transfer?
Can systems and teams actually honor access, deletion, correction, preference, or other applicable requests?
Is data kept because there is a reason, or because no one owns deletion?
Did model use, inference, vendor behavior, or new purpose change the privacy decision?
What buyers usually need clarified.
Does this determine every privacy law that applies?
The engagement evaluates privacy obligations in context. Formal legal interpretation should be coordinated with qualified counsel where needed.
Do you include AI-related privacy risk?
Yes. AI use tends to change privacy risk in ways a standard assessment can miss, including inference-based data that was never directly collected, vendor and subprocessor relationships introduced through embedded AI features, and transparency obligations that shift once a model is making or influencing decisions about people. We treat AI use as its own line of inquiry rather than folding it into a generic vendor or technology question.
Can this lead into DPO support?
Yes, when ongoing privacy governance is the actual need. The assessment is still a bounded engagement and does not require a retainer.
How long does a privacy compliance assessment take?
Most engagements run several weeks, depending on the number of jurisdictions, products, and data flows involved.
Do you work with our legal counsel?
Yes. This is operational and advisory work, designed to complement legal counsel rather than replace formal legal interpretation.
Make the privacy program match the way the business actually uses data.
Bring us the new product, AI use case, jurisdiction expansion, privacy backlog, vendor problem, or governance question. We will start with processing reality.
You do not need to diagnose the exact engagement before contacting us. Bring the pressure, milestone, or decision.
Talk Through the AssessmentExplore All Assessments