One privacy office across the group.
Apply the right regime to each processing activity while keeping one operating model, one control language and one leadership view.
Regional coverage, locally appliedVIRTUAL DPO · PRIVACY OFFICE AS A SERVICE
A privacy office that keeps pace with the business.
Falconry provides the privacy leadership, operational capacity and regional context to manage privacy across entities and regimes—while Falconry360 keeps every activity, decision, clock and evidence visible.
Illustrative platform viewWHY ORGANISATIONS USE A VIRTUAL DPO
Outsource privacy capacity without outsourcing judgement.
A virtual DPO is a working privacy office: it maintains the records, handles the queue, challenges the business, supports the regulator and leaves the organisation with a defensible trail.
Put a named function in place.
Give management and the board a credible privacy contact while internal capability, staffing or registration arrangements are being established.
A functioning privacy officeMake privacy by design repeatable.
Assess new products, AI, cloud, marketing, HR and transformation changes before they become an unresolved privacy exposure.
DPIA decisions before deploymentRespond within the right clock.
Run intake, verification, search, redaction, notification and closure against the statutory requirements that govern the case.
A queue with the clock attachedSee the supply chain.
Review processor clauses, sub-processors, transfers and assurance evidence using the same supplier and contract records as cyber risk.
Privacy risk by supplierChallenge commercial convenience.
Maintain an access model and escalation path that lets privacy advice remain objective, including when the answer is uncomfortable.
Advice that can stand upWHAT FALCONRY OPERATES
Privacy work becomes a service catalogue, not a collection of documents.
Each activity is configured in Falconry360 with a governing regime, responsible owner, due date, evidence requirement and escalation route.
1 · Govern the office
Define the privacy mandate, reporting line, conflict position, policy lifecycle, training obligations and committee cadence.
2 · Maintain the record
Keep ROPA, lawful basis, retention, data categories, systems, suppliers and transfers current as the estate changes.
3 · Assess the change
Triage and review DPIAs, legitimate-interest assessments, AI use cases, new vendors and product changes before launch.
4 · Run rights requests
Manage intake, verification, system search, redaction, response, extensions and closure with the governing statutory clock visible.
5 · Respond to incidents
Assess thresholds, coordinate notifications, preserve decisions and evidence, and track post-breach actions to closure.
6 · Prove accountability
Prepare regulator correspondence, customer due diligence, board reporting, training evidence and an orderly handover to the appointed officer.
THE PRIVACY OPERATING RHYTHM
The work lands where the DPO can govern it.
No spreadsheet hand-offs. No hidden clocks. No “we will update the ROPA later”.
01
Map the perimeter
Confirm entities, processing activities, jurisdictions, systems, suppliers, data owners and the first risk priorities.
02
Configure the office
Load regulatory packs, define roles and clocks, configure ROPA, DPIA, rights, transfer and incident workflows.
03
Run the queue
Operate weekly case reviews, monthly privacy reporting, change intake and processor-assurance cycles.
04
Challenge and advise
Provide written advice, escalation and decision options to product, HR, marketing, technology and leadership.
05
Transfer or scale
Build the internal privacy capability, add entities or retain selected operations while the client keeps the decision rights.
WHAT THE CLIENT RECEIVES
A privacy office that can answer “what happened?”
The value is not only closing today’s request. It is being able to show the record, the decision, the evidence and the reason the organisation can stand behind it.
Privacy queue
- Rights requests and statutory clocks
- DPIA and change intake
- Incidents and escalations
- Evidence and approvals due
Management view
- ROPA and transfer currency
- Processor and supplier exposure
- Training and policy attestation
- Open advice and decisions
Leadership position
- Privacy risk and trend
- Material incidents and lessons
- Regulatory and customer readiness
- Investment and capability needs
Response support
- Regulator correspondence
- Rights-request surge support
- Breach assessment and notification
- Transaction or product due diligence
INDEPENDENCE AND BOUNDARIES
A virtual DPO must be clear about the role it can hold.
Where a regime allows an external appointment and no conflict exists, Falconry can provide the designated privacy function. Where the officer must be an employee, or where our other work creates a conflict, we will structure the engagement as independent advisory support to your appointed officer.
The client retains policy approval, risk acceptance and the legal responsibility for the organisation’s compliance position. Falconry provides the operating capacity, challenge, documentation and evidence.
Our working principle
Privacy advice should be independent enough to say no, operational enough to say what happens next and evidenced enough to stand up afterwards.