Four markets, one programme
We serve organisations in the United Kingdom, Germany, France and the Netherlands — and teams elsewhere selling into them. One control set, mapped to each market's expectations.
By geography
Europe and the UK, under one programme
GDPR and the certifications European procurement asks to see
European procurement asks two questions before anything else: how you handle personal data, and where. We answer both on this page — and build the programme that keeps the answers true.
How we deliver here
The practical details
Time zones, presence, contracting and where the work actually happens.
Where the work happens, stated plainly
The delivery team works from India. What that means for your data is contractual, not vague: processing locations, transfer mechanisms and access are documented before work starts — because your DPO will ask.
Hours that overlap yours
India runs a few hours ahead of Europe, so the overlap covers the European morning and early afternoon — where the standing meetings, reviews and workshops are scheduled.
What we run for you
The work itself
Delivered by our specialists, not handed to you as a template pack.
GRC ProgramGDPR, ISO 27001 and ISO 27701 run as one programme — a control implemented once, evidenced for every counterparty.AI SecurityGovernance for models under the emerging EU AI rules — risk classification, documentation and the controls ISO 42001 formalises.AI IdentityThe identities your AI agents act through — scoped, governed and auditable before a regulator asks how.Supply Chain SecurityYour processors and sub-processors assessed and monitored — the register your GDPR obligations already assume exists.vCISO as a ServiceA named security owner for the buyers, boards and DPOs who ask who is accountable.
How the engagement works
What actually happens
The same four beats every time, scoped to how this market buys.
Scope the data flows
Where personal data comes from, where it goes and under which transfer mechanism — mapped before controls are chosen.
Build once, map many
One control set crosswalked to GDPR, ISO 27001 and 27701, so privacy and security stop being parallel programmes.
Evidence continuously
Controls produce evidence as they run, which is what turns a DPO's question or a customer audit into a lookup.
Carry the audits
We manage certification bodies and customer assessments, and answer findings until they close — inside your working day.
Proof
Track record
Across every engagement we have run, in every region.
0+
Companies Secured
Zero
Failed Audits
4-8
Weeks to Compliance
0+
Team Certifications
What you walk away with
The artefacts
Everything below is a thing you own at the end, not a promise about the process.
- Records of processing activities and a maintained data map
- Transfer impact assessments and documented processing locations
- One control set crosswalked to GDPR, ISO 27001 and ISO 27701
- Completed certifications European buyers recognise
- A processor and sub-processor register with assessment evidence
- Penetration test and retest reports
- A reusable answer set for European procurement and DPO questionnaires
Related
Where to go next
The problems companies in this market usually arrive with, and the services behind them.
Questions
What people ask in this market
The team works from India. What we access, from where and under which safeguards is documented in the engagement terms — processing locations and transfer mechanisms are stated before work begins, not negotiated after.
The United Kingdom, Germany, France and the Netherlands today, plus teams elsewhere selling into those markets. The programme itself is the same GDPR-plus-ISO build everywhere.
ISO 27701 extends 27001 with privacy management, and for GDPR-heavy buyers it is the certificate that answers the privacy half of the questionnaire. On an existing 27001 base it is an extension, not a second programme.
Yes — SOC 2 rides on the same control set. Many clients hold ISO 27001 for European counterparties and SOC 2 for US ones, evidenced from one implementation.
Answers your DPO will accept.
Tell us where your customers and your data sit. We will map the obligations, the transfer mechanics and the certificates that close the questions.