A regulator does not assess your policy document. It assesses whether what the policy describes is what the business actually does — which is why we build compliance from the data outward: what you hold, why you are allowed to hold it, where it goes, and who can show that on the day someone asks.
Most privacy programmes fail the same way. A set of policies is drafted, approved and circulated; the business carries on collecting, sharing and exporting personal data exactly as it did before; and eighteen months later a subject access request, a vendor's security questionnaire or a regulator's enquiry asks the one question the policies never answered — where is this data, and on what basis do you hold it?
We work in the opposite order. The data estate is mapped first: what is collected, by which system, on what lawful basis, shared with whom, held for how long, and moved across which borders. Everything else — the records of processing, the notices, the retention schedule, the transfer mechanism, the impact assessments — is then a description of something that is true, which is the only kind of compliance that survives an audit.
The two regimes we run are the UAE PDPL and the GDPR in its EU and UK forms, and most of our clients are subject to both at once. That overlap is where the practice lives: a group operating between the Gulf and Europe does not need two programmes, it needs one framework that satisfies the stricter test in each place it applies — and a clear account of where the two genuinely diverge.
Call us when
A first mandate is usually the whole of the first area. The other three are where the programme is kept true after it goes live.
01
The foundation everything else rests on: what personal data the business actually holds, in which systems, on what basis, and for how long — measured against the regimes that apply to it.
02
The policies, notices and contracts that describe the mapped estate — drafted to be operable by the people who will have to run them, rather than to be comprehensive on paper.
03
The half of the work that most often goes undocumented. Where data leaves a jurisdiction, the mechanism has to exist before the transfer does — and it has to match how the group actually operates.
04
What happens when the framework is tested. Impact assessments before a risk is taken, a rehearsed response when something goes wrong, and periodic audit so the record stays true as the business changes.
The order matters more than the pace. A framework written before the estate is mapped describes a business that does not exist, and that is the failure mode we are hired to undo most often.
01
Which regimes reach which entities, and where you stand against each of them today. The output is a ranked list of exposures with the regulatory consequence attached — not a score out of a hundred.
Week 1–2
02
Interviews with the teams that actually handle the data, system by system, until the inventory reflects practice rather than intention. This is the longest stage and the one that determines whether everything after it is worth anything.
Week 2–5
03
Each processing activity assigned a basis that can be defended, and each border crossing given a mechanism. Where a flow cannot be justified, it is flagged as something to change rather than something to document.
Week 4–7
04
Policies, notices, records of processing, retention schedule, processor terms and the request and breach procedures — drafted against the mapped estate and written to be followed by non-lawyers.
Week 6–10
05
Owners named, routines placed in the systems that will run them, and the teams trained on the parts they touch. A framework nobody has been shown is a framework that will be contradicted within a quarter.
Week 8–14
06
Periodic audit against the record, DPIAs as new processing is proposed, and a stated review cycle — plus a rehearsed path for the two things that arrive without warning: a data subject request and a breach.
Ongoing
Most of our clients are subject to more than one of these at once. The framework is built to satisfy the stricter test wherever they overlap.
Sitting between the Gulf and Europe is the common case, not the exception — and it is the case this practice was built for.
See the jurisdictionsAnswers here are general. Which of them applies to your business depends on where it operates and what it holds — that is what the assessment establishes.
It can, and frequently does. The GDPR follows the data subject rather than the company — offering goods or services to people in the EU or the UK, or monitoring their behaviour, brings a business within scope regardless of where it is established. A UAE group with European customers, European staff or a European group entity is usually subject to both regimes at once.
Establishing exactly which entities are in scope of which regime is the first stage of the mandate, not an assumption we make.
It is the visible part and rarely the substantive one. A regulator's questions are about the estate behind the policy: which systems hold personal data, on what basis, shared with whom, retained how long, transferred where. A policy that describes a business accurately is valuable; one drafted before anyone looked is a statement you can be held to and cannot evidence.
Eight to fourteen weeks from gap assessment to an operating framework, for a single business of moderate complexity. The variable is almost never the drafting — it is how quickly the people who actually handle the data can be sat down and asked what they do with it.
Groups with multiple entities and shared systems run longer, and are scoped by entity so the first one is live while the rest are still being mapped.
Say so in the first line of your message. Requests and breaches both run on statutory clocks measured in days, and they are triaged ahead of programme work. We will deal with the response in front of you first, then be honest about whether the fact that it caught you unprepared is itself worth addressing.
It depends on what you process and at what scale, and the tests differ between the PDPL and the GDPR. Where an appointment is required we say so plainly; where it is not, we say that too rather than selling a role you do not need. What every business does need is a named person accountable for the framework — that is a governance point, not a statutory one.
That is how the mapping stage works — it is conducted with the people who run the systems, not around them. On the vendor side we review the contracts you already have and tell you which ones do the job, which need amending, and which represent a transfer with no mechanism behind it.
Practice 01
The same craft against a different regime: anti-dumping, countervailing and safeguard proceedings run from the notice of initiation through to the determination and the reviews that follow it.
Tell us what the business holds and where it operates. The Director tells you which regimes reach you and what the real exposure is — within one business day.
