Skip to content
penby.

Service 02

GDPR compliance shouldn't still be a spreadsheet from 2018.

GDPR has been in force for eight years and your compliance still lives in a spreadsheet someone created in 2018. Your processor agreements are unsigned or outdated. Your data mapping is incomplete. And now your team is feeding personal data into AI tools that nobody has assessed – LLMs, chatbots, AI-powered analytics – adding new data flows that your existing architecture doesn't account for. It's not malicious. It's just that nobody with the right expertise has sat down and built the architecture properly, including for the AI tools that are now part of your operations.

What we build

  • Data protection strategies grounded in how your business actually operates, not a template
  • Data Protection Impact Assessments for marketing campaigns, AI tools, lead generation, and customer communications
  • Processor and controller agreements that reflect your real data flows – including AI processors
  • AI tool assessments – what personal data goes into LLMs and AI services, where it's stored, and what your obligations are
  • International data transfer mechanisms for businesses operating across UK and EU
  • Records of processing activities that are maintained, not forgotten
Typically for SMEs without a dedicated DPO Financial services firms Businesses using AI tools that process personal data

Why us

Andy is ICO registered, a member of the IAPP and BCS, and holds the AI Governance Professional credential – backed by two decades of building compliant systems in financial services and international advisory. He has worked with AI tools daily since 2022 and understands how they process data in practice, not just in theory. This means DPIAs that account for how your AI tools actually behave, processor assessments that ask the right questions, and data protection architecture that covers the tools your team adopted last month as well as the systems you've had for years.

Other services

All services
01

Privacy-Compliant Marketing

Your campaigns are running. Your consent architecture isn't keeping up.

 03

Marketing Technology

Your marketing data is unreliable and you're making decisions in the dark.

 04

Regulated Content

You need content, but your agency can't write for a regulated industry.

Recognise the problem?

If any of this sounds familiar, we should talk. No pitch, no twelve-slide capabilities deck. Just a direct conversation about your situation and whether we're the right people to help.

Start a conversation