Data protection
Data protection and GDPR, handled properly, without hiring a full-time DPO.
We act as your outsourced Data Protection Officer and privacy team: building the records, policies and processes the ICO expects, answering the questions your customers ask in due diligence, and being on hand when something goes wrong.
Data Protection
Data protection and GDPR, handled properly — without hiring a full-time DPO.
We act as your outsourced Data Protection Officer and privacy team: building the records, policies and processes the ICO expects, answering the questions your customers ask in due diligence, and being on hand when something goes wrong.
Do you need a DPO?
Some organisations must appoint one. Many more should.
UK GDPR requires a Data Protection Officer in defined circumstances. Even where it isn’t mandatory, an independent DPO is increasingly a condition of winning enterprise and public sector contracts.
It’s a legal requirement
Public authorities, and organisations carrying out large-scale monitoring or processing special category data, must appoint a DPO.
Your customers demand it
Enterprise procurement and security questionnaires routinely ask who your DPO is and how privacy is governed.
Your risk has outgrown your process
Growing data volumes, new AI tooling and international transfers introduce obligations most in-house teams aren’t resourced for.
International governance
Keeping foreign businesses legal when expanding into UK and EU markets.
What’s included
A complete privacy function, on retainer.
Named DPO
A named, independent Data Protection Officer registered with the ICO and available to your team, regulators and customers.
UK and EU representation
For organisations based outside the EU or UK that process personal data about EU or UK individuals, KH InfoSec can act as the appointed GDPR Representative in the relevant jurisdiction.
Gap analysis
A structured assessment against UK GDPR and the Data Protection Act, with a prioritised remediation plan.
Data mapping & ROPA
Privacy notices, retention schedules, and internal policies written for your business rather than pulled from a template.
DPIAs & legitimate interest assessments
Impact assessments for new systems, AI tooling and high-risk processing — documented to the standard the ICO expects.
DSAR handling
A working process for data subject access requests, plus support on the difficult ones inside the statutory deadline.
Processor & supplier agreements
Review of data processing agreements, sub-processor chains and international transfer safeguards.
Training & awareness
Training staff to handle data security responsibly and recognise phishing and suspicious correspondence via regular simulation and short video training.
International transfers
Transfer risk assessments and the right mechanism for moving data outside the UK and EEA.
Outsourced vs in-house
Why most growing businesses outsource the role
- Full-time in-house DPO
- £60,000–£90,000+ salary
- Conflict of interest risk if combined with an IT or legal role
- One person’s experience
- No cover for leave or turnover
- KH-InfoSec Data Protection service
- Fixed monthly retainer
- Structurally independent, as the regulation intends
- Cross-sector privacy and security experience
- Continuous cover, with escalation when it matters
How we work
A straightforward four-step process.
01
Establish
We map your processing, review what already exists and assess you against UK GDPR. You get a clear picture of your obligations and where you fall short.
02
Remediate
We work through the prioritised plan ROPA, notices, policies, retention, processor agreements, building the evidence base as we go.
03
Operate
Your named DPO takes on the ongoing work: DSARs, DPIAs, supplier reviews, breach decisions and the privacy questions that arrive with every new contract.
04
Report
Regular reporting to your board or management team on privacy risk, incidents and progress — in language non-specialists can act on.
Frequently asked questions
Data protection questions we hear often.
Are we legally required to appoint a DPO?
You must appoint one if you are a public authority, or if you carry out large-scale systematic monitoring or large-scale processing of special category data. If you are unsure, we assess this as part of the initial review and document the decision either way, which is itself good practice.
How is this different from your Fractional CISO service?
The Fractional CISO role covers information security strategy and governance. The Data Protection service covers privacy law compliance and the statutory DPO duties. Many clients take both, delivered as a single engagement; the DPO duties are kept independent as the regulation requires.
Can you take on an existing GDPR programme?
Yes. We review what you already have, keep what works and focus effort on the gaps rather than starting again from a blank page.
What happens if we have a personal data breach?
You contact us immediately. We help assess whether the incident is reportable, advise on containment and communications, make the reporting decision with you inside the 72-hour window, and document the whole thing for the record.
Does this cover AI tools we’re starting to use?
Yes.
Do you handle ICO registration and correspondence?
Yes, we maintain your ICO registration and act as the point of contact for regulator correspondence on your behalf.
Not sure where your data protection stands?
Book a free discovery call and we’ll tell you honestly what’s required and what isn’t.