Data Protection

Overview

Privacy starts with knowing what you process

Privacy work goes wrong at the start, in the mapping. An organisation that cannot say which processing it does, in which role, and on whose behalf, cannot answer a data subject, assess a transfer, or judge whether a new AI feature is lawful. Everything downstream inherits that gap.

Closing that gap is connective tissue rather than a policy set: records that are maintained rather than reconstructed, assessments reopened when a purpose changes, and rights handling that does not depend on one person knowing where things are. In Switzerland the law behind it is rarely only the GDPR, which is one more reason the mapping has to be yours rather than a template's.

Professional tracks

Halderstone tracks follow a modular structure. They first establish a strong, role-specific foundation across disciplines, which is then applied to the chosen discipline.

Data Protection · ISO/IEC 27701ISO/IEC 27701 AuditorAuditing privacy management beyond legal documentation◎Diploma in Management System Auditing◎Halderstone Certified ISO/IEC 27701 Auditor20 modules · capstone · examView the track →

Data Protection · ISO/IEC 27701Data Protection ManagerMake data protection a managed capability, not a reactive obligation◎Diploma in Management System Management◎Halderstone Certified Data Protection Manager23 modules · capstone · examView the track →

Training modules

Each module can be taken on its own and trains the calls a practitioner has to make without being prompted. These are the modules that teach this discipline; the cross-discipline core that every track shares is in the catalogue.

HAM-DP-A-02 · Data ProtectionAuditing Operational Privacy ControlsEvaluate whether privacy controls are implemented effectively and applied consistently across personal data processing activitiesView details →

HAM-DP-A-01 · Data ProtectionAuditing Privacy Risk & Impact AssessmentEvaluate whether privacy risk assessments and DPIAs produce credible risk understanding and prioritisation in an ISO/IEC 27701 PIMSView details →

HAM-DP-DF-01 · Data ProtectionData Protection PrinciplesPrivacy roles, obligations and controls in organisations, aligned with common national and international data protection requirementsView details →

HAM-DP-S-03 · Data ProtectionOperational Privacy ControlsImplement role-based privacy controls and data subject rights handling within an ISO/IEC 27701-aligned PIMSView details →

HAM-DP-S-01 · Data ProtectionPII Processing: Context, Roles & ScopeDefine PII processing context, determine controller and processor roles, and set practical PIMS scope boundaries under ISO/IEC 27701View details →

HAM-DP-S-02 · Data ProtectionPrivacy Risk & Impact Assessment (DPIA)Assess privacy risks, reason about impacts, and document DPIAs within an ISO/IEC 27701-aligned PIMSView details →

Advisory

We help organisations translate data protection requirements into workable governance, roles, processes and controls. This includes privacy management structures, risk-based assessments, operational integration across the data lifecycle, and documentation that supports accountability, regulatory expectations and sustainable compliance in day-to-day practice.

The four phases below are the life of a management system, and an engagement can begin at any one of them.

1. 01

   Design

   Establishing clear data protection governance and accountability

   –Data protection governance framework and policy design

   –Definition of roles and responsibilities (e.g. controller, processor, DPO)

   –DPIA methodology and risk classification

   –Design of data inventories and processing records

   –Integration into existing management systems and governance structures

   –Design of documentation and evidence structures

2. 02

   Operate

   Embedding data protection into daily practice

   –Execution of Data Protection Impact Assessments (DPIAs) and risk assessments

   –Operational processes for data protection lifecycle management

   –Handling of data subject requests

   –Incident and breach handling processes

   –Supplier onboarding and data processing agreements and controls

   –Enablement of key roles (management, legal, IT, business)

3. 03

   Assure

   Providing confidence and audit readiness

   –Independent reviews of data protection governance

   –Compliance and implementation effectiveness checks

   –Review of Data Protection Impact Assessments (DPIAs) and other documentation

   –Supplier and third-party data protection reviews

   –Preparation for internal and external audits or regulatory reviews

4. 04

   Evolve

   Keeping data protection effective as requirements and practices change

   –Monitoring regulatory developments and guidance

   –Maturity assessments and improvement roadmaps

   –Integration of new use cases and technologies

   –Scenario analysis for cross-border data processing

   –Executive sparring on strategic data protection decisions

Audit

A privacy programme audit follows the risk to people rather than the paperwork: whether that risk drives the controls, whether the controls survive a change of purpose or supplier, and whether the reviews would find a gap before a data subject does.