Governance, Risk & Compliance · Govern
GDPR compliance fails most often not at the policy level but at the point where a right has to be honoured or data actually deleted. We build the practical side: records of processing that reflect what truly happens to personal data, lawful basis per purpose, retention that genuinely removes data, and subject rights handling that works within the statutory timescales. International transfers, transfer assessments and processor oversight are addressed explicitly rather than assumed. The work is designed to be run by your own teams, with the evidence produced in the course of operation rather than assembled when a regulator asks.
In short
GDPR compliance work establishes lawful basis, records, rights handling and transfer arrangements for personal data. It is built to operate in the systems and teams that handle the data, rather than to sit as a policy nobody consults.
Start a conversationWhat we do
We build records of processing that reflect what actually happens to personal data, not what a form once claimed. Accurate records are the foundation for every other obligation, because you cannot protect or delete data you have not located. The mapping routinely uncovers copies and exports nobody had accounted for.
We establish a lawful basis for each processing purpose and align privacy notices with what the organisation really does. A notice that overstates or misstates processing is itself a compliance failure and a reputational risk. Settling the basis per purpose also clarifies which rights apply, since they differ by basis.
We make subject access, deletion and objection workable within the statutory timescales, with templates and a defined route. A request that cannot be answered in time is both a breach and a signal that the underlying data is not under control. Retention is implemented so data is genuinely deleted on schedule, which almost always requires system change rather than policy alone.
We address international transfers, the assessments they require, and the contracts and oversight that govern processors. Transfers out of the EEA need a lawful mechanism and, increasingly, a documented assessment of the destination. Processor oversight is made ongoing rather than a one-off contract clause, since the controller remains accountable for what processors do.
What you receive
Documented output your teams keep and can act on without us in the room.
When this work helps
How an engagement runs
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.
Where we work
Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.
Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.
Related services
HIPAA compliance work implements the safeguards and agreements required when handling protected health information. There is no official HIPAA certificate, so compliance is shown through a documented risk analysis, implemented safeguards and the evidence behind them.
NIST framework implementation uses the Cybersecurity Framework to assess maturity and plan improvement across functions. It is a structured way to decide where to invest, not a certification, and its value is in the roadmap it produces.
Business continuity and disaster recovery planning establishes how the organisation keeps operating and recovers when systems or sites fail. An untested plan is an assumption, so the work is only finished once an exercise has shown it holds.
Questions
Straight answers to what buyers ask us before an engagement begins.
Enquiries
Your enquiry lands in the same inbox as every other on this site and is read by us. Tell us the requirement and we will reply with a practical next step.
Prefer email? contact@fidovaadvisory.com
Next step
