Effective governance defines who decides, who implements and how evidence is maintained. Scope can include security policies, governance frameworks, privacy risk reviews, data protection controls, third-party risk management, continuity governance and compliance gap analysis.
For Kenyan organizations, the Data Protection Act, 2019 and ODPC guidance provide relevant context for personal data handling. Applicability, controller or processor obligations, registration and cross-border processing requirements depend on the organization and its activities. Technical readiness work supports, but does not replace, legal advice or regulatory decisions. We do not provide legal certification.
What we focus on
- Security policy development
- Privacy risk and data controls
- Third-party risk
- Evidence readiness
- Continuity governance
Clear, useful deliverables.
The final scope determines the deliverables included in your engagement.
- Policy and accountability framework
- Privacy and control gap summary
- Evidence register
- Compliance readiness roadmap
A considered engagement process.
- 01Understand processing and operating context
- 02Agree applicable references with advisers
- 03Review policies and evidence
- 04Map gaps and ownership
- 05Prepare remediation and evidence plan
Your questions, answered.
What will we agree before work begins?
We define objectives, assets and data involved, access requirements, deliverables, exclusions and acceptance criteria. Availability and the delivery team are confirmed before a written scope is agreed.
What can our team expect to receive?
The agreed deliverables can include policy and accountability framework, privacy and control gap summary, evidence register, compliance readiness roadmap. Recommendations identify priorities and next steps; implementation and follow-up are scoped separately unless included in the agreement.
How do we start?
Book an initial consultation to discuss security governance, privacy & compliance readiness. The consultation clarifies needs and scope; it does not constitute a completed assessment, certification or implementation.
Reference: ODPC guidance. Regulatory applicability requires a context-specific review.