Skip to main content
Ian Job

Remote GRC service

GDPR Compliance Consultant

Remote GDPR compliance support for security and privacy teams: data mapping, records of processing, DPIAs, Article 32 security controls, processor contracts and 72-hour breach readiness.

Send a request Works remotely. Available for consulting, contract and full-time engagements worldwide.

GDPR compliance sits between legal, privacy and security. Security teams carry much of the operational load: knowing where personal data lives, protecting it with controls appropriate to the risk, and being ready to assess and report a breach within 72 hours.

Ian helps organisations build the operational side of GDPR compliance and keep it running. This is practical compliance support, not legal advice; it works alongside your DPO or legal counsel. Available as a consulting project, a fixed-term contract or as part of a full-time remote role, depending on what your organisation needs.

Who it is for

  • Organisations processing EU personal data that need to show accountability under Article 5(2).
  • Security teams asked to evidence Article 32 security of processing.
  • Businesses preparing for customer due diligence questionnaires on data protection.

What is included

  • Personal data inventory and data flow map.
  • Records of processing activities (Article 30) with owners and lawful bases.
  • DPIA screening and DPIA support for high-risk processing (Article 35).
  • PII protection controls: encryption, access, retention, masking and logging.
  • Processor review and Article 28 contract checklist.
  • Breach assessment procedure, breach log and tabletop exercise.

How it works

  1. 1Discover. Map personal data, systems, suppliers and transfers with the people who own them.
  2. 2Assess. Compare current practice with GDPR obligations and rate the gaps by risk.
  3. 3Implement. Create the records, procedures and controls that close the highest-risk gaps first.
  4. 4Operate. Set review cycles, train data handlers and rehearse breach decisions.

Frequently asked questions

Is a GDPR consultant the same as a Data Protection Officer?

No. A DPO is a formal role with specific tasks under Articles 37 to 39. A consultant helps build and run the compliance program and can support the DPO, but does not replace a required DPO appointment.

What does GDPR Article 32 require from security teams?

Security appropriate to the risk, such as encryption and pseudonymisation, ongoing confidentiality, integrity, availability and resilience, the ability to restore data after an incident, and regular testing of controls.

Where should a small business start with GDPR?

With a data map and records of processing. Every other obligation, from security to data subject requests, depends on knowing what personal data you hold and where.

Free resources

Work together

Share your role, contract or project and Ian will reply by email to discuss scope and timing.

Go to the request form