Assess · Solution 03
Data Protection & Information Handling Review
Find out where personal information sits, who can reach it, how long it is kept, and whether you are ready to respond to a data breach.
- Stage
- Assess
- Timeframe
- Typically four to six weeks.
- You receive
- 5 named deliverables
- Fee
- Fixed, agreed in writing first
- Who it is for
- Organisations that hold health, financial, identity or children's information, or that want to be ready before an incident rather than after one.
- The problem
- You are not certain where personal information is stored, which suppliers hold it, how long it is kept, or whether you could assess and notify a serious breach within the time the Notifiable Data Breaches scheme expects.
- Scope
- Data inventory across up to eight core systems and key suppliers.
- Policy and process review of how personal information is secured, retained and destroyed (APP 11).
- Review of supplier and third-party handling of personal information.
- Assessment of breach response readiness against the Notifiable Data Breaches scheme.
- A tabletop exercise with your response team.
- You receive
- Personal-information data map.
- APP 11 control gap register.
- Retention and destruction schedule recommendations.
- Data breach response plan.
- Tabletop exercise report with improvement actions.
- Timeframe
- Typically four to six weeks.
- Fee
- Every engagement is fixed-fee. We confirm scope and fee in writing after a free scoping call, before any work starts.
- Not included
- No penetration testing or technical security assessment. Where that is needed, we recommend you engage a specialist security provider.
- No live incident response. If you are dealing with a suspected breach now, contact your legal adviser and refer to the OAIC's data breach guidance.
- No legal advice and no guarantee of compliance.
Data protection starts with knowing what you hold. The review builds that picture, then tests whether your controls and your response plan would hold up under pressure.
How it runs
- 01
Scoping call
Agree the systems, suppliers and teams in scope, and confirm the fee in writing.
- 02
Inventory
Workshops and questionnaires with system owners to build the data map.
- 03
Review
Assessment of security, retention and supplier controls at policy and process level.
- 04
Exercise and report
A realistic breach scenario run with your team, then the full findings.
What usually comes next. Findings usually feed a Privacy Governance Framework or a Data Governance Framework.
You cannot protect information you have not found.
Questions
Is this a cybersecurity audit?
No. We look at governance, policy and process for personal information. Technical testing of systems is a separate discipline and should be done by a security specialist.
What does the tabletop exercise involve?
A facilitated session of about two hours where your team works through a realistic breach scenario, decision by decision, so gaps show up before a real incident does.
Start with a conversation.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.