Framework first. Vendor-neutral.
A documented study comes before any recommendation. We advise on what is needed and leave the choice of product to a process you can defend.
Four stages, each with a document you keep.
You can stop after any stage and still hold something usable.
Study
Interviews, document review, and a walk-through of systems and data flows. Output: findings and a risk register.
Framework
Policies, standards, decision rights and draft contract clauses. Output: a policy set the organisation can adopt.
Specification
Requirements for the tools and controls the gaps call for. Output: a vendor-neutral specification.
Assurance
Periodic reviews, board reporting and audit support. Output: a dated review pack.
Four commitments.
These shape every engagement.
Evidence over assertion
A finding rests on a document, a system check or an interview, and says which.
Proportionate to risk
Controls scale to the data held and the harm if it is misused. We do not recommend a heavier control than the risk needs.
Plain language
Reports are written so a director can follow the reasoning and an engineer can act on it.
Independent of vendors
We do not resell software. When a tool is needed, we write the requirement and stay out of the selection’s commercial side.
Findings you can sequence and defend.
A typical study closes with a readiness assessment, a register of what was found and a plan in priority order.
- Data inventory and data-flow map. Systems, processors and transfers on one page each.
- Risk register. Each risk with its legal basis, likelihood, impact and owner.
- Policy and procedure set. Drafted to your systems and your sector.
- Board note. The decision points, in plain language.
Readiness by area legal basis · score out of 100
| Area | Score | |
|---|---|---|
| Notice and consent | 58 | |
| Rights and grievance | 64 | |
| Processor oversight | 45 | |
| Security safeguards | 71 | |
| Breach response | 49 | |
| Children’s data | 38 | |
| Retention and erasure | 52 |
Overall
Priority findings legal basis and effort side by side
| # | Finding | Basis | Priority | |
|---|---|---|---|---|
| 1 | Consent text bundles marketing with service delivery | s.6 | Low | P1 |
| 2 | No documented escalation path for reporting a breach to the Board | s.8(6) | Medium | P1 |
| 3 | Processor contracts lack deletion and sub-processor terms | s.8(2) | Medium | P2 |
| 4 | No verifiable-consent step for users who may be minors | s.9 | High | P2 |
| 5 | Retention schedule exists for 3 of 11 systems | s.8(7) | Medium | P3 |
Qanalyx provides regulatory and technology advisory. It is not a law firm and does not offer legal representation or opinions on a client’s legal position. Where a matter needs a legal opinion, we work alongside counsel appointed by the client.
Start with a conversation.
Tell us what you hold and what you need it to do. We reply within one working day.