N Catalyst.ai
Book a demo
The situation
A mid-sized company collects customer data through a website, a call centre and a field sales team, stores it in a CRM and two spreadsheets, and shares some of it with a logistics partner and a payments provider. It has a privacy policy copied from somewhere in 2019.
The Digital Personal Data Protection Act requires notice, a lawful basis, a route for data principals to exercise rights, a response to breaches, and in some cases a Data Protection Officer. None of that is onerous in itself. All of it requires knowing what data you hold, which nobody has written down.
Why it is hard
The data map is the work
Notices, consent, retention and breach response all depend on knowing what is collected, where it sits and who it goes to. Every other deliverable is downstream of that one, and it is the one nobody has.
A copied privacy policy is a liability
A notice that describes processing you do not do, and omits processing you do, is worse than an honest short one. It is also evidence.
Breach response is a timetable, not a document
The obligation is to act within a window. A playbook that is not written down before the breach is not a playbook.
How we approach it
Kanoon IQ Citizen works through the readiness set as documents rather than as a project: consent and collection notices drafted against the processing the business actually does, a data inventory built by walking the systems and contracts, processor terms checked against what the Act requires, a breach-response playbook with the timetable in it, and a DPO workflow for handling data principal requests.
Each deliverable is drafted for review by an advocate or the person accountable inside the business. The point is that the documents exist, match reality and can be produced, not that a tool has pronounced the company compliant.
What changes
- A data inventory built from the systems and contracts in use
- Notices drafted against actual processing rather than copied
- Breach response written as a timetable before it is needed
- A workflow for data principal requests, with the documents behind it
Next
Is this your problem too?
Bring the version of it you actually have. We will tell you what it would take, including when the answer is that it is not worth doing.