Privacy, Data Protection & Security
Build security practices around the protection of sensitive and personal information while considering applicable regulatory requirements.
Privacy regulation asks a question most systems were not designed to answer: what personal data do you hold, where is it, who can reach it, and how long does it stay. Answering that is a security and architecture problem long before it is a legal one.
Our role is the security side of that. We help establish where personal data actually lives, what protects it and where the controls do not match the sensitivity of what they are protecting.
What is privacy and data protection compliance work?
This covers readiness and compliance work across three distinct regulatory frameworks. HIPAA is a US framework covering protected health information, focused on safeguards over health information, access control and handling of PHI. GDPR is the EU regulation covering personal data of individuals in the EU, focused on lawful handling, data minimisation and security appropriate to the risk. DPDP is India’s Digital Personal Data Protection framework, covering obligations around personal data with security expectations attached. Not every framework applies to every organization; which are relevant depends on where you operate and whose data you hold. The practical starting point is usually mapping where personal data actually is, since it typically spreads into places like analytics warehouses, reports and third-party integrations that are never recorded in one place.
Who needs it? Organizations that have started handling personal data as part of a product change, organizations expanding into a new jurisdiction whose data now falls under a regime they have not designed for, organizations facing a due-diligence questionnaire from a customer or partner they cannot yet answer, and organizations whose data flows have outgrown their original documentation.
How TMG Security helps. TMG Security maps where personal data actually is, identifies which frameworks are relevant to your organization, and works through the access management, data mapping, consent and retention considerations each framework raises, delivering output leadership can act on.
Data spreads faster than the map of it
Personal data rarely stays where it was collected. It is copied into an analytics warehouse, exported for a report, synced to a support tool and cached by a third-party integration — each step reasonable, none of them recorded in one place.
By the time a regulation asks where personal data is held, the honest answer often takes weeks to assemble. Building that picture is the practical starting point, because every control decision afterwards depends on it.
How this is put together.
Each stage carries access, security, privacy and control questions. The hard part is usually knowing which stages your data is actually in.
What each one is actually for.
Select a framework to see its focus and the considerations it usually raises.
Not every framework applies to every organization. Which are relevant depends on your sector, your customers and where you operate.
What this covers
SCOPE OF SERVICETMG Security provides cybersecurity and compliance support. We are not an auditor, a certification body or a law firm, and nothing here is legal advice. Organizations should obtain legal advice for legal or regulatory interpretation.
How we approach it
- 01DISCOVEREstablish where personal data is actually held.
- 02CLASSIFYUnderstand sensitivity and which requirements attach.
- 03REVIEWAssess the controls protecting each location.
- 04GAPIdentify where protection does not match sensitivity.
- 05PRIORITISERank by exposure and by what is straightforward to change.
- 06SUPPORTHelp implement and document the improvements.
When Do Privacy Requirements Reach Your Systems?
Output leadership can act on.
Which of these apply depends on engagement scope.
Where current practice differs from the requirements that apply to you.
Which controls address which requirements, and where nothing does.
What the gaps mean in terms of risk, not just non-conformity.
What needs to exist in writing, and what it needs to say.
Whether you could demonstrate a control operates, if asked.
Sequenced work, with dependencies made explicit.
A version of the findings that a board or exec team can act on.
Adjacent parts of the programme.
How pricing and scope are determined
There is no published fixed price for privacy and data protection compliance work. Each engagement is scoped and priced individually based on factors such as which regulatory frameworks are relevant to your organization, the volume and complexity of personal data involved, and the number of systems that handle it. These factors are discussed during scoping before a quote is provided.
Questions we get asked before an engagement.
No. We work on the security and technical side — where data lives, what protects it, whether access is appropriate. Interpretation of a regulation, lawful basis and regulatory position are matters for qualified legal counsel, and we would say so rather than guess.
No provider can honestly promise that, and we would treat the claim as a warning sign. Compliance depends on your practices, your legal interpretation and in some cases an external assessment. We can materially improve the security posture that underpins it.
Data discovery, almost always. Every subsequent decision — access, retention, encryption, third-party sharing — depends on knowing where personal data actually is, and that answer is usually broader than expected.
Substantially, on the security side. The safeguards these regulations expect look a lot like the controls those frameworks describe, so work done for one usually carries over. The privacy-specific obligations sit on top.
Timelines depend on which regulatory frameworks are relevant to your organization, the volume and complexity of personal data involved, and the number of systems that handle it. These factors are discussed during scoping.
Discuss Privacy & Data Protection
Tell us what personal data you hold and which regimes you think apply. The first useful step is usually finding out where that data actually is.