Online Legal

This audit looks at the key legal elements your website should include to operate properly. We check how user data is handled, what information is collected and how it is communicated. We also review the presence and structure of essential pages such as privacy policy, cookies and terms. You receive clear feedback on what is missing, incomplete or unclear, along with practical recommendations that can be implemented easily. The goal is to help you understand exactly where your website stands and what needs to be done next.

GDPR compliance isn't a one-time checkbox — it touches how you collect data, store it, process it, share it and respond when someone asks what you hold on them. We review your website and associated business processes against the core GDPR requirements: lawful basis for processing, consent quality, cookie and tracking compliance, data subject rights (access, erasure, portability), and your relationships with third-party processors such as CRMs, email platforms and analytics tools. You receive a prioritised compliance gap report with clear, actionable steps — and an honest view of where your current exposure lies.

The Digital Operational Resilience Act sets binding requirements for financial entities and their ICT service providers across the EU — covering risk management, incident reporting, resilience testing and third-party oversight. Non-compliance carries significant regulatory risk. We assess your current posture across all five DORA pillars, identify where your policies, processes and contracts fall short of the requirements, and deliver a structured readiness report with a prioritised remediation roadmap. The assessment is practical and scoped to your organisation's size and role — not a generic enterprise framework applied regardless of context.

NIS2 significantly expands the scope of EU cybersecurity obligations — bringing medium and large businesses across a wide range of sectors under binding requirements for risk management, incident reporting, business continuity and supply chain security. Many organisations don't yet know whether they're in scope, let alone whether they're compliant. We start by confirming your classification, then assess your current cybersecurity governance, technical measures and incident handling processes against the NIS2 requirements. You receive a clear gap analysis with a prioritised action plan sized to your organisation — not a framework designed for enterprises ten times your size.

Keeping data longer than necessary, processing it without a clear lawful basis or failing to document what you hold and why are among the most common compliance failures — and among the most penalised. We review your data retention schedules, processing activities, deletion procedures and records of processing against GDPR requirements and relevant sector obligations. We assess whether the data you hold is justified, whether it's being disposed of correctly and whether your documentation would withstand scrutiny from a regulator. You receive a practical audit report with specific policy improvements and a retention schedule template calibrated to your business.