Frequently Asked Questions

Here are answers to some of the questions I'm most commonly asked. If you'd prefer to discuss your organisation's specific circumstances, please don't hesitate to get in touch.

Many organisations do, but not all. The answer depends on the type of organisation you run and how you use personal information. If you're unsure, get in touch and I'll help you understand whether registration is required.

Do I need to register with the ICO?

What if I've never done any GDPR work before?

That's completely fine. Many organisations get in touch because they know data protection is important but aren't sure where to start. I can help you understand your responsibilities, identify any gaps and prioritise the most important actions.

How long does an audit take?

This depends on the size and complexity of your organisation. Most small organisations can complete the questionnaire within a couple of hours, and reports are typically delivered within two weeks of receiving the required information.

What's the difference between a remote audit and an on-site audit?

A remote audit is carried out using a questionnaire and document review and is often sufficient for smaller organisations.

An on-site audit includes a visit to your premises, allowing me to review physical arrangements, discuss processes in more detail and gain a better understanding of how your organisation operates.

Will you write our policies and other documents?

Yes. I can help draft or review privacy notices, data protection policies, data breach procedures, records of processing activities and other compliance documents. I aim to produce documents that are practical, proportionate and easy to maintain.

How much do your services cost?

Prices for my core services are published on the website, so you'll know exactly what to expect before making contact. For additional work, I'll always discuss the scope and cost with you before any work begins.

You'll receive a written report explaining my findings in plain English, together with a prioritised action plan. I'll also be happy to answer any questions and discuss how you would like to address any recommendations.

What happens after the audit?

No! The aim of an audit isn't to catch you out. Most organisations are already doing many things well. My role is to identify areas for improvement, explain any risks and provide practical recommendations to help you move forward with confidence.

Will you tell us we're doing everything wrong?

Why should I choose a specialist data protection consultant?

I focus exclusively on data protection and information governance, providing specialist advice tailored to the needs of small organisations, charities and community groups.

Data protection isn't something I do alongside other services - it's the only thing I do. That means the time I spend keeping up with UK GDPR, PECR, and ICO guidance goes directly into the advice you receive, rather than being one small part of a broader workload.

Yes. All work is carried out personally by me. From your initial enquiry through to the final report, you'll deal directly with a qualified practitioner who understands your organisation and its requirements.

Will I be dealing with the same person throughout?

Yes - if you send marketing emails or text messages to customers, supporters or members, the Privacy and Electronic Communications Regulations (PECR) apply alongside UK GDPR. PECR sets out specific rules about consent for electronic marketing and applies to businesses, charities and community organisations alike. If you're unsure whether your marketing communications are compliant, get in touch and I can help you work through it.

Does data protection law cover my email marketing?

Simply get in touch using the contact form or email me at hello@threecountiesdata.co.uk. We can have an informal conversation about your organisation, your concerns and whether my services are the right fit for you. I can offer on-site visits throughout Worcestershire, Herefordshire and Gloucestershire, and remote services across the UK.