Governance, Risk & Compliance · Govern
Personal data tends to spread across systems faster than anyone maps it, and privacy obligations now arrive from several regimes at once. We build data protection into operations across the lifecycle: classification so you know what you hold, minimisation and retention that actually reduce it, impact assessments for higher-risk processing, and rights handling that works in practice. Obligations from the regimes that apply to you — India's DPDP Act, GDPR and others — are mapped onto a single control set rather than duplicated. The hardest part is usually retention and deletion, which requires system change rather than policy, and that is where we tend to concentrate the effort.
In short
Data privacy and protection work establishes lawful, minimised and secure handling of personal data across its lifecycle. It maps the obligations of the regimes that apply to you — including India's DPDP Act and GDPR where relevant — onto one control set rather than running separate programmes.
Start a conversationWhat we do
We establish what personal data you hold, where it sits and who can reach it. You cannot minimise, secure or delete data you have not located, so the map underpins every other control. Classification then lets protection be applied in proportion to sensitivity rather than uniformly across everything.
We reduce what is collected and kept, and implement retention that genuinely deletes on schedule. Data not held cannot be breached, mis-used or subject to a rights request, so minimisation lowers both cost and risk at once. Retention is the step most often written on paper but never enforced, and we make it actually run in the systems.
We run assessments for higher-risk processing, including profiling and new AI or analytics use. These assessments surface risks while a design can still be changed, rather than after launch when change is costly. They also produce the documented reasoning that regulators increasingly expect to see for sensitive processing.
We make rights requests workable within the statutory timescales and align security controls with the sensitivity of the data. A rights process that cannot be met in time is both a breach and a sign the underlying data is not under control. Mapping security controls to classification ensures the most sensitive data gets the strongest protection without over-engineering the rest.
What you receive
Documented output your teams keep and can act on without us in the room.
When this work helps
How an engagement runs
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.
Where we work
Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.
Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.
Related services
Risk register management keeps the register accurate, owned and used — rather than a document reviewed once a year and trusted by no one. Its value lies in the discipline around it: specific statements, consistent scoring, named owners and a cadence that keeps it current.
Audit readiness and support prepares the organisation, evidence and people for an external audit, and supports it while it runs. A gap disclosed with a remediation plan is handled far better than one the auditor discovers, which is the principle the whole exercise follows.
Security awareness and compliance training gives staff the specific knowledge their role requires, with records that satisfy obligations. Generic training tied to nobody's actual job changes little behaviour and convinces no auditor.
Questions
Straight answers to what buyers ask us before an engagement begins.
Enquiries
Your enquiry lands in the same inbox as every other on this site and is read by us. Tell us the requirement and we will reply with a practical next step.
Prefer email? contact@fidovaadvisory.com
Next step
