Data governance & privacy workflows
Keep control of your information and business knowledge in an AI-powered world. We help you understand what you hold, who can use it, and how requests are handled, with people responsible for the decisions.
The problem
Nobody is sure which spreadsheet is current, how long messages are kept, or who is allowed to look. When a customer, a member of staff or someone acting for them asks for information, the search starts from scratch and the deadline is easy to miss.
What you receive
- A plain record of what personal information the business holds, where it lives, and why
- Named owners for business records and shared knowledge, including guidance on what can be used with AI tools
- Agreed rules for who can see information, and how a colleague asks for access
- Retention and deletion steps that say how long things are kept and how they are removed
- A workflow for requests, with the stages below
- A record of what was done, so the business can show its working later
How the work usually breaks down
Not every request is a subject access request
A subject access request asks for a copy of a person’s own personal information. Asking you to correct a mistake, delete information, restrict its use, object to it, or provide it so it can be moved elsewhere are different rights. A member of staff asking for a login or a file is an internal access request. The workflow names which kind of request it is, because the steps and the deadline are not always the same.
The stages we can help you run
Intake, so the request and the date are recorded. Identity or authority checks, where those are appropriate, including when someone asks on another person’s behalf. Locating the records in the places you actually keep them. Assigning an owner. Tracking the deadline that applies. Review and redaction, so information about other people is considered before anything is released. Approved delivery by a method you have chosen. An audit note of what was sent, withheld, corrected or deleted, and who approved it.
Deadlines
For many requests under the UK GDPR, the Information Commissioner’s Office expects a response without undue delay and within one month of the request, or of any identity, authority or fee information that was properly required. Extra time is allowed only in specific cases, and the person has to be told. Some requests follow different rules. The workflow stores the deadline for that request rather than assuming every request is identical.
Good to know
- We do not claim automatic GDPR compliance, a legal certification, or a system that discloses or deletes information on its own.
- Consequential decisions stay with authorised people in the business. We can prepare the file and the checklist. We do not approve the disclosure for you.
- Please do not send customer records, identity documents or a live subject access request through the enquiry form on this website.
- This description is operational. It is drawn from current ICO guidance and it is not a substitute for advice on your own situation. Sources are listed in the project notes.
Next step
Tell us whether you need a map of what you hold, a request workflow, or help with both. Do not attach the records themselves.