What I can help you with.

Leading a GDPR Art. 42 certification programme means far more than filling in a checklist. I manage the full lifecycle — defining the Target of Evaluation, scoping the certification perimeter, preparing all certification documentation, coordinating with certification consultants and auditors, and ensuring your product meets the standard across every applicable jurisdiction.

I conduct Article 35 DPIAs and Transfer Impact Assessments grounded in EDPB Recommendations 01/2020 (EU TIA) and ICO guidance (UK TRA). This includes assessing third-country legal frameworks — US (FISA §702, EO 12333, CLOUD Act), India (IT Act §69, DPDPA 2023), and others — with documented supplementary measures where needed.

International transfers require precision — the wrong module, a missing docking clause, or an unaddressed transfer route creates real regulatory exposure. I draft and negotiate the full documentation suite: IGDTA incorporating EU SCCs (Decision 2021/914) across all applicable modules (C2C, C2P, P2SP), UK IDTA, India Accession Agreements, and third-party DPAs.

As a mandatory DPO under Art. 37(1)(b) GDPR, I understand what the role actually requires. For companies that need a qualified DPO but aren't ready for a full-time hire, I provide fractional DPO services — from formal appointment and regulatory correspondence to ongoing programme oversight and staff guidance.

Privacy operations break down in practice when intake is unclear, SLAs aren't tracked, and handoffs between teams aren't documented. I design and implement DSAR programmes that scale — from intake triage and identity verification through to response drafting, SLA tracking, and backlog clearance.

Privacy by design isn't a box to tick at the end of a sprint. I work cross-functionally with Product, Engineering, and Support teams to embed privacy controls into the development lifecycle — data flow mapping, data minimisation reviews, geofencing analysis, and privacy-aware feature design.

Compliance documentation is only useful if it reflects actual practice and covers every legal requirement. I draft, review, and remediate privacy notices, cookie policies, retention schedules, ROPAs, and DPAs — identifying gaps against GDPR, UK GDPR, CCPA, and HIPAA with specific, actionable findings.

The EU AI Act is in force. GPAI model providers and high-risk AI system operators face real obligations — including conformity assessments, technical documentation, and transparency requirements. I map your AI systems against the Act's risk classification framework, identify applicable obligations, and build the documentation and governance structures you need.