Build · Solution 02
Privacy Governance Framework
Design and roll out the policies, roles and procedures that make privacy an operating part of your organisation, not a document on a shelf.
- Stage
- Build
- Timeframe
- Typically six to ten weeks, depending on the size of the organisation and how many documents already exist.
- You receive
- 6 named deliverables
- Fee
- Fixed, agreed in writing first
- Who it is for
- Organisations that know where their privacy gaps are, from a Lexora review or elsewhere, and need a working program to close them.
- The problem
- Policies exist, but nobody clearly owns privacy decisions, privacy impact assessments happen late or not at all, and staff are unsure what to do when a request or incident arrives.
- Scope
- A design workshop with your leadership to agree ownership, decision rights and risk appetite.
- Drafting of the framework documents, tailored to how your organisation actually works.
- Review rounds with your team until the documents are approved.
- Rollout support, including a staff training session.
- You receive
- Privacy management plan, as expected under APP 1.
- Roles and accountabilities, including the privacy officer role.
- Procedures for access and correction requests, privacy complaints, and retention and destruction.
- Privacy impact assessment template and register.
- Staff training session and materials.
- An annual privacy governance calendar.
- Timeframe
- Typically six to ten weeks, depending on the size of the organisation and how many documents already exist.
- Fee
- Every engagement is fixed-fee. We confirm scope and fee in writing after a free scoping call, before any work starts.
- Not included
- We do not draft contracts or provide legal advice.
- Approval and ongoing operation of the framework remain your organisation's responsibility.
- No guarantee of compliance.
A privacy governance framework turns obligations into ownership: who decides, who checks, what gets recorded and when the board hears about it.
How it runs
- 01
Design workshop
A half-day session to agree who decides what, and how privacy risk is escalated.
- 02
Drafting
We draft the framework in plain English, built around your systems and teams.
- 03
Review and approval
Your team reviews and approves every document. You own the final framework.
- 04
Rollout
Training for staff and the people who will run the framework day to day.
What usually comes next. Ongoing Advisory keeps the framework current as your systems, suppliers and obligations change.
A privacy framework works when the people who run it helped design it.
Questions
Do we need a review first?
Not necessarily. If you already have a clear, recent gap analysis, we can start from it. If not, a Privacy Compliance Review makes the framework faster and better targeted.
Will you use templates?
We use our own structure as a starting point, but every document is written around your organisation. A framework copied from elsewhere tends not to be followed.
Start with a conversation.
A free 20-minute call to understand your situation and recommend the right first step. Scope and a fixed fee are confirmed in writing before any work starts.