Data Privacy Impact Assessment
Systematic evaluation of data handling practices to ensure compliance with privacy regulations and identify potential privacy risks.
In scope
- Data flow mapping
- Privacy risk assessment
- Consent mechanism review
- Data protection controls evaluation
- Third-party data sharing analysis
You receive
- Privacy impact assessment report
- Risk mitigation recommendations
- Privacy control improvements
- Compliance gap analysis
- Implementation roadmap
Tiers
Choose the depth.
Small Organization DPIA
$20K
DPIA for an organization of up to 100 employees: up to 5 processing activities and up to 5 third-party data recipients. Data flow maps, privacy risk assessment, consent mechanism review, report with mitigations and roadmap.
- employees
- 100
- vendors
- 5
- Data flow mapping for up to 5 processing activities
- Privacy risk assessment with rated risks
- Consent mechanism review
- Third-party sharing analysis for up to 5 recipients
- DPIA report, gap analysis and roadmap
- — More than 5 processing activities
- — Implementing the recommended controls
- — Policy or notice drafting
- — Regulator consultation
Medium Organization DPIA
$35K
DPIA for up to 500 employees: up to 15 processing activities and up to 15 third-party data recipients. Same method as Small with workshops per business unit and a data protection controls evaluation per system.
- employees
- 500
- vendors
- 15
- Data flow mapping for up to 15 processing activities
- Workshops with each business unit in scope
- Data protection controls evaluation per system
- Third-party sharing analysis for up to 15 recipients
- DPIA report, gap analysis and roadmap
- — More than 15 processing activities
- — Implementing the recommended controls
- — Policy or notice drafting
Large Organization DPIA
$55K
DPIA for up to 2,500 employees: up to 40 processing activities and up to 40 third-party data recipients, including cross-border transfers. Larger estates are scoped separately.
- employees
- 2500
- vendors
- 40
- Data flow mapping for up to 40 processing activities
- Cross-border transfer analysis
- Data protection controls evaluation per system
- Third-party sharing analysis for up to 40 recipients
- Consolidated DPIA report with per-activity annexes
- Roadmap with owners
- — Implementing the recommended controls
- — Full privacy program build (see Data Privacy Compliance Program)
- — Legal opinions
Members: engagement coupons from the CISO Marketplace coupon book apply to services. There is no blanket discount.
What's inside this engagement
Phase by phase.
How a readiness & governance assessment engagement runs, what happens in each phase and what you see. Exact scope, tier and timeline are fixed in your proposal and SOW.
01Scoping & framework selection
The standard or regulation, the systems and the business units in scope are fixed.
You see · Your audit or regulatory driver.
02Evidence collection & interviews
Policies, configurations and records reviewed; control owners interviewed.
You see · Documents and time with control owners.
03Gap analysis
Each requirement mapped to current state: met, partial or missing, with the evidence behind it.
You see · A clear gap register.
04Roadmap & evidence plan
Prioritized remediation with owners, and the evidence an auditor will ask for.
You see · A plan you can execute or hand to us.
Commercials
From first call to final report.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Related
Continuous Attack Surface Monitoring
Comprehensive continuous monitoring of your external attack surface with regular assessments and testing.
Active Directory Security Assessment
Comprehensive security assessment of Active Directory infrastructure, focusing on privilege escalation, lateral movement, and domain compromise scenarios.
Business Continuity Planning Assessment
Comprehensive evaluation of your organization's business continuity capabilities and operational resilience through detailed Business Impact Analysis (BIA), risk assessment, and continuity planning. Our specialized approach combines regulatory compliance requirements with practical business resilience strategies to ensure your organization can maintain critical operations during disruptions and recover effectively from various business interruption scenarios.
Research
Latest from the blog
incident-response · Sep 22, 2026
The Revolut Breach Is a Case Study in Confusing Authentication With Authorization
Revolut disclosed customer data to attackers who spoofed a government agency's email domain for five months. The root cause was not weak email security but a workflow that treated a valid domain as proof of a valid request.
compliance · Aug 26, 2026
€825 Million for an Algorithm: The Uber Fine Is the First Real Price Tag on Automated Decision-Making
On August 21, 2026, the Dutch DPA fined Uber €824.99 million — the second-largest GDPR penalty ever — not for a breach, not for a transfer mechanism, but for Article 22: automated decisions made about people without meaningful human involvement. Every organization deploying agents that act on humans just got a valuation. Here is what the decision actually requires.
events · Aug 8, 2026
BSidesLV 2026: The Track That Called ChainDrop a Day Early, and Why Ground Truth Is the Best Data in Vegas
While Black Hat filled Mandalay Bay, BSidesLV ran August 3–5 at the Tuscany with the research that had no vendor budget behind it. The [un]prompted AI track warned about agentic worm risk the day before ChainDrop poisoned 444 npm packages. Ground Truth put vishing success at up to 36% and dissected 95 red team engagements. Proving Ground's npm supply chain talk read like a prophecy.
Start an engagement