Questions we get asked before every call
Is this just for large businesses?
No. In recruitment alone, around 79.5% of UK agencies are micro-businesses with no in-house legal counsel, and the fine exposure doesn't scale down with headcount. Smaller teams often have the least capacity to build a defensible position on their own, which is exactly where this earns its cost fastest.
Do I need to upload actual customer or candidate data?
No, and you never will. The questionnaire asks about how your process works — who reviews what, what data your tool uses, how long it's kept — not about any specific individual. That's a deliberate design decision: it keeps real personal data out of our systems entirely.
Does a favourable report mean we're legally compliant?
No, and we're deliberate about never saying that. The report tells you your assessed risk and where the evidence gaps are. It is not a certificate of compliance and not a substitute for legal advice on your specific circumstances.
What happens when the ICO publishes its final guidance or the statutory code?
We re-base the affected items in the schema and flag exactly which findings in your existing report are affected. On the annual plan, reassessment against the updated rules is included, not a separate paid engagement.
We're a group with several divisions — can they each run their own assessment?
Yes. The account structure supports up to five levels of hierarchy from day one — group, company, division, business unit, and team — with each level able to run its own assessments while a group admin retains oversight across the whole structure.