Data Privacy

Know what personal data you hold, where it goes, and whether your controls keep the promises in your privacy notice.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Know what you collect. Keep the promises you make.

The challenge

Ask most or­ga­ni­za­tions what per­son­al data they hold, where it lives, and which ven­dors re­ceive it, and the hon­est an­swer is a par­tial one. The pri­va­cy no­tice on the web­site makes promis­es the sys­tems were never built to keep. State pri­va­cy laws keep mul­ti­ply­ing, cus­tomer ques­tion­naires get sharp­er every year, and new AI tools pull per­son­al data into places no­body mapped.

How we help

We start with the data. Working with your busi­ness, IT, and legal teams, we map what per­son­al in­for­ma­tion you col­lect, why you col­lect it, where it's stored, who can reach it, which ven­dors re­ceive it, and how long you keep it. That map be­comes the base for every pri­va­cy de­ci­sion that fol­lows.

Then we as­sess your pri­va­cy pro­gram against the laws and frame­works that apply to you. We test whether the con­trols be­hind your pri­va­cy no­tice ac­tu­al­ly work: con­sent and pref­er­ence han­dling, data sub­ject re­quests, re­ten­tion and dele­tion, ac­cess re­stric­tions, and the pri­va­cy terms in ven­dor con­tracts. For new sys­tems and AI use cases, we run pri­va­cy im­pact as­sess­ments so the risks sur­face at de­sign time, not after launch.

If you're pur­su­ing ISO/IEC 27701, we pre­pare you for the cer­ti­fi­ca­tion audit the same way we pre­pare clients for ISO/IEC 27001. Every gap comes back in a pri­or­i­tized plan, with an owner and a dead­line.

Standards we work with: The NIST Privacy Framework, ISO/IEC 27701, the GDPR, the CCPA as amend­ed by the CPRA, the New Jersey Data Privacy Act and other U.S. state pri­va­cy laws, and the pri­va­cy pro­vi­sions of GLBA and HIPAA.

We aren't a law firm and don't give legal ad­vice. Your coun­sel de­cides what the law re­quires; we as­sess and build the con­trols that put it into prac­tice. Only an ac­cred­it­ed cer­ti­fi­ca­tion body can cer­ti­fy you to ISO/IEC 27701.

Good fit if you can't say for cer­tain where your cus­tomers' per­son­al data goes, or a new law, con­tract, or AI project has raised pri­va­cy ques­tions you can't yet an­swer.

Related topics

  • Data privacy assessment
  • Privacy program assessment
  • Data mapping
  • Privacy impact assessment
  • ISO/IEC 27701 readiness
  • NIST Privacy Framework
  • State privacy law readiness

Services in Data Privacy

Select a service to see what it covers.

Data Mapping and Inventory

A map of the personal data you collect, why you collect it, where it lives, who can reach it, and which vendors receive it.

Every privacy decision depends on knowing what personal data you hold. We work with your business, IT, and legal teams to map what you collect, why, where it's stored, who can reach it, and how long you keep it.

What's included

  • A personal data inventory
  • Data flow maps across systems and vendors
  • Retention and access findings

Ask about this service

Privacy Program Assessment

An assessment of your privacy program against the laws and frameworks that apply, including tests of the controls behind your privacy notice.

We assess your program against the laws and frameworks that apply to you, then test whether the controls behind your privacy notice work, including consent handling, data subject requests, and deletion.

What's included

  • Assessment against applicable laws and frameworks
  • Testing of consent, data subject requests, and deletion
  • A prioritized remediation plan with owners

Ask about this service

Privacy Impact Assessments

Privacy impact assessments for new systems, vendors, and AI use cases, so risks surface at design time rather than after launch.

Privacy risks are cheapest to fix at design time. We set up the triggers and templates for privacy impact assessments and run them for new systems, vendors, and AI use cases.

What's included

  • Assessment templates and triggers
  • Assessments for new systems and vendors
  • AI use-case privacy reviews

Ask about this service

ISO/IEC 27701 Readiness

Gap assessment and privacy information management system build-out ahead of ISO/IEC 27701 certification.

ISO/IEC 27701 extends an information security management system to cover privacy. We assess your gaps as a controller, a processor, or both, and help you prepare for the certification audit.

What's included

  • PIMS scope and gap assessment
  • Controller and processor control mapping
  • Certification readiness planning

Ask about this service

Explore our other practice areas

IT & Cybersecurity Audit Advisory

Risk-based IT audits, ITGC and application control testing, and cybersecurity and cloud assessments, with findings owners can act on.

Learn more about IT & Cybersecurity Audit Advisory

Governance, Risk & Compliance

Risk assessments, security policies, vendor oversight, and SOC 2 and ISO 27001 readiness, run as one connected program.

Learn more about Governance, Risk & Compliance

AI Governance

AI readiness, inventory, policy, and oversight, so every use of AI is visible, valuable, and accounted for.

Learn more about AI Governance

AI Risk, Security, and Audit

Risk assessments, security control reviews, and audits that show whether your AI holds up in daily use, and not only in policy.

Learn more about AI Risk, Security, and Audit

Forensic Accounting & Fraud Risk

Evidence-first analysis of financial irregularities, and of the control gaps that let them happen.

Learn more about Forensic Accounting & Fraud Risk

Professional Training

Workshops and cohorts that build audit, AI governance, and GRC skills inside your team.

Learn more about Professional Training

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor