Week 1
Scoping
Written scope, access arrangements and a named engagement lead confirmed.
Risk, Compliance & Resilience
Data Protection Compliance Review
UK GDPR position, records of processing, retention and subject rights handling.
- Engagement
- 5–7 weeks
- Format
- Assessment
- Indicative fee
- From £1,550
- First consultation
- No fee
Overview
What this engagement covers
UK GDPR position, records of processing, retention and subject rights handling. Delivered as a discrete engagement within our Risk, Compliance & Resilience programme, data protection compliance review is scoped against the size, form and obligations of your organisation rather than a fixed corporate template.
Why it matters
The case for doing this properly
- Boards and funders increasingly expect decisions to be evidenced, not asserted.
- Internal teams rarely have protected time to step outside delivery and examine structure.
- An independent view removes the internal politics that stall difficult decisions.
- Doing this work before a funding round or inspection is materially cheaper than doing it after.
Our methodology
How the engagement runs
01
Position
We compile the obligations that apply to your form, funding and activity.
02
Analysis
Controls are tested against those obligations and gaps quantified by exposure.
03
Design
Registers, policies and response plans are designed at a proportionate scale.
04
Embed
We run a live exercise and set the ongoing review and reporting cycle.
Deliverables
What you receive
- A written baseline report setting out findings and their evidence
- Recommendations prioritised by impact, cost and urgency
- Templates, registers or documentation appropriate to the engagement
- A board-ready summary presentation
- An implementation plan with owners and dates
- A twelve-month review point
Benefits
What changes as a result
- Decisions supported by documented evidence
- Capability retained inside the organisation after handover
- Reduced exposure to regulatory, funding and delivery risk
- A clear, sequenced plan instead of a list of problems
Who it is for
Charities · CICs · Social Enterprises · Public Sector · Education · Faith Organisations
Timeline
A typical engagement, week by week
Weeks 2–3
Evidence
Document review, interviews and data collection against the agreed method.
Mid-point
Emerging findings
A working session tests findings before anything is written up formally.
Close
Report & handover
Final report, board briefing and an implementation plan with named owners.
Typical engagement
5–7 weeks
Typical engagements run 5–7 weeks, delivered assessment and governance format. Fees are fixed where scope allows and stated in writing before work begins.
From £1,550 — indicative starting fee, confirmed in writing after scoping.
Outputs
- Baseline report
- Recommendations register
- Board presentation
- Implementation plan
- Twelve-month assurance schedule
Case study
Engagement record
Crescent Covenant CIC launched in 2026. Published engagement records for this service will appear here as work completes and clients consent to publication. We do not publish illustrative or composite case studies.
Testimonials will be published alongside each record, attributed and verifiable.
FAQs
Common questions
Related services
More in Risk, Compliance & Resilience
Related practices & resources
Where this connects
Next step
Discuss data protection compliance review
Every engagement begins with a consultation at no fee: we establish the question, confirm whether we are the right adviser, and set out scope in writing before anything is committed.
Next step
Speak to the advisory team
Tell us where your organisation is now. A structured 60–90 minute assessment, a written findings note within five working days, and no fee for the initial session.