Advisory & Data Protection
Know exactly how compliant you are — a structured GDPR assessment plus a Record of Processing Activities that satisfies Article 30 and stays maintainable.
Most organisations believe they're broadly GDPR-compliant; few can prove it. A data protection assessment replaces that assumption with evidence: a structured, comprehensive review of your policies, procedures, controls and practices against UK data protection legislation and the GDPR, showing exactly where you stand and what the regulator would find if they came looking.
Blackfoot's certified data protection professionals examine the areas where compliance actually fails — data handling processes, consent mechanisms, privacy notices, international transfer arrangements and security controls. The output is a clear report: what's compliant, what isn't, and pragmatic, prioritised recommendations for closing the gaps without gold-plating anything.
The natural next step is documentation. UK and EU data protection law requires most organisations to maintain a Record of Processing Activities (ROPA) — a comprehensive account of what personal data you process, why, on what legal basis, where it goes, how long you keep it and how it's protected. It's the document regulators typically ask for first, and the one most organisations quietly don't have.
Our ROPA service builds it properly. Starting from a data mapping exercise, our experts work with stakeholders across your organisation to identify how personal information is used, verify the legal bases for processing, and validate where data is stored and the security controls protecting it. You receive a GDPR-compliant ROPA in a clear, easy-to-understand format designed to be maintained over time — not a one-off artefact that's stale within a quarter of delivery.
Together, assessment and ROPA give you the two things every privacy programme rests on: an honest picture of your position and defensible documentation of your processing. From there, an external DPO can take ongoing ownership, or GDPR can be managed continuously as a framework in our Compliance as a Service subscription on Clarity.
A structured review against UK GDPR and DPA requirements, showing your true position rather than your assumed one.
Certified data protection professionals with cross-sector delivery experience — people who know what the ICO actually looks for.
Recommendations ranked by risk and effort, proportionate to your organisation — no compliance theatre.
A complete, GDPR-compliant Record of Processing Activities built from real data mapping, not template guesswork.
Processing purposes and lawful bases identified and validated with the people who actually use the data.
ROPA delivered in a clear format your team can keep current — with ongoing upkeep available through our DPO and managed services.
We agree which entities, processes and jurisdictions are in scope and gather your existing privacy documentation.
Our experts review policies, processes, consent, notices, transfers and security controls against UK GDPR and DPA requirements.
You receive a clear findings report with prioritised, proportionate recommendations — and a walkthrough so nothing is left ambiguous.
Working with stakeholders across the business, we map your personal data processing and build your Record of Processing Activities.
The ROPA is handed over in a maintainable format, with options for ongoing upkeep via our external DPO service or a GDPR framework in Clarity.
Straight answers to what prospective clients ask us most.
A comprehensive evaluation of your organisation's compliance with UK data protection legislation and the GDPR. It reviews your policies, procedures, controls and practices — including consent, privacy notices and data transfers — and reports the gaps with prioritised recommendations.
Most organisations do. UK and EU data protection law requires records documenting how you collect and process personal information — purposes, legal bases, data types, transfers, retention and security. It's also typically the first document a regulator requests.
It starts with data mapping: identifying what personal information you hold, where it resides and how it flows. We then document purposes and legal bases, transfers and safeguards, retention schedules and security controls — validated with the stakeholders who actually process the data.
An assessment typically completes within a few weeks depending on your size and complexity; the ROPA follows, driven by stakeholder availability across departments. We plan both around your team's diaries and keep the demand on any individual light.
You act on the prioritised findings — with our support if you want it, from policy updates to appointing an external DPO. Many clients then keep GDPR continuously maintained as a framework in Compliance as a Service on our Clarity portal.
Get a fixed-scope quote, usually the same working day.
