Not every organisation is required to appoint one. The obligation depends on what your organisation does with personal data, not simply on how big it is, so a small business can fall within scope while a larger one does not.
The quickest way to find out is a short conversation. Book a free discovery call and we will tell you honestly whether you need a DPO, whether a lighter-touch retainer would serve you better, or whether you are already doing enough.
A fractional DPO gives you the expertise of a Data Protection Officer without the cost of a full-time appointment. You get a named specialist who knows your organisation, rather than a helpdesk.
In the organisations where Cristina fulfils the DPO role, she works as a trusted key member of the senior leadership team. That is the difference between an outsourced DPO who is genuinely embedded and one who simply files reports.
For a microbusiness, the programme can be completed in as little as three months. For larger organisations, a timeline of six to twelve months is more typical.
The honest answer is that it depends on where you are starting from, which is what the initial gap analysis establishes.
Three stages. First a gap analysis, which gives you a tangible picture of your risk exposure and where the gaps are. Second an action plan, which is a traceable and structured plan to reduce that risk, with clear focus and ownership. Third implementation, which leaves you with a solid governance framework supported by policies, processes and procedures, accountability, and a maintenance cycle.
Throughout, CVG Solutions guides and supports you so that you can focus on running your business.
Being GDPR compliant is a requirement for every business, large or small. It is the law, but it also brings real commercial benefits, and many businesses use it as part of their unique selling point.
That is especially true if you are targeting corporate clients. They will carry out GDPR due diligence on your business, and the outcome will determine whether they do business with you or not.
Cristina Vannini-Goodchild is a fully qualified CIPP/E and C-DPO data protection specialist with over thirty years of C-level experience in large, complex, multinational organisations including EDS/HP, BSi, General Motors and Serco.
At Serco, as Head of Data Governance, she implemented GDPR across all central functions and all divisions covering the UK and Europe, and established a Data Protection Office to provide structured, continuing governance.
CVG Solutions is a multi-award-winning practice, and Cristina is supported by Emily Overton as Associate Senior Consultant.
Yes. Cristina has worked with organisations across multiple industries, sizes and levels of complexity, including charities, and acts as DPO for charity clients.
One charity client has said that Cristina has been recognised by their local authorities for her professionalism, support and contributions, raising the profile and confidence of the charity.
The GDPR Toolkit is a subscription for businesses that want to put GDPR into practice themselves with expert material behind them. It contains forty-four documents covering policies, privacy notices, data protection agreements, processes and practical tools, each one accompanied by video instructions.
Subscribers also receive updates reflecting the latest legislative changes, an hour and a half of Cristina’s time, and access to the Knowledge Vault of bite-size videos, tips, webinars and FAQs.
It costs £24.91 a month for twelve consecutive months.
Yes, either face to face or as online sessions. Training is delivered as interactive seminars for small groups, or as presentations for a larger audience.
Sessions use relatable material, real case studies and exercises. Every learner receives a workbook and a certificate of attendance, and material can be tailored to your requirements to create bespoke content.
There are separate programmes for teams and for leadership.
CVG Solutions is based in Boston, Lincolnshire, and works with clients across the United Kingdom. Consultancy, training and DPO support can all be delivered remotely as well as in person.