Privacy education built around implementation

Our mission

To make practical data protection capability freely available to the people who have to deliver it — so that good privacy outcomes do not depend on the size of an organisation's budget or the maturity of its legal function.

Why this exists

Most people responsible for privacy did not set out to be. They are engineers, IT leads, operations managers and compliance officers who inherited the topic when a customer questionnaire, a new market or a regulator made it unavoidable. The training available to them tends to fall into two camps: legal courses that explain the statute in depth without ever touching a system, and vendor courses that explain a product.

The gap in between is where privacy programmes actually fail. Nobody struggles because they cannot recite the six lawful bases. They struggle because the inventory is out of date, the rights process depends on one person's memory, retention exists only in a policy document, and an AI assistant has just been switched on over a decade of unreviewed content.

How we teach

Courses are structured in short modules, each with a quiz that checks understanding rather than recall of trivia. Every course finishes with a longer final assessment, and passing it produces a certificate with a verification ID that anyone can check. This is practical education, not a professional accreditation. Alongside courses, we publish templates and checklists you can use directly, jurisdiction guides, and browser-based tools that give you a prioritised view of your own gaps in minutes.

Our methodology

1. Understand the obligation. Start from the structure that recurs across frameworks — scope, roles, lawful grounds, rights, transfers, security, accountability — rather than one statute's numbering.
2. Locate the data. Nothing works until you know where personal and sensitive data actually lives, which systems copy it and who can reach it. Discovery precedes policy.
3. Change the system, not the policy. Rights handling, retention and vendor controls have to exist as workflows and configuration. A document that describes an intention is not a control.
4. Prove and maintain it. Registers, decision records, review dates and evidence you can hand to a customer or regulator. Programmes fail on maintenance far more often than on design.

Editorial and source policy

Guidance is written against primary sources — the text of the law, the regulator's own guidance and official supervisory-authority publications — and every jurisdiction guide links to those sources so you can check the position yourself. Material carries a last-reviewed date and is updated when a position shifts. We publish no sponsored content, accept no vendor influence over what we recommend, and correct errors quickly when they are reported.

What we do commercially

The education is free and stays free. Where organisations want hands-on help — a readiness assessment, programme implementation, data discovery strategy, a Microsoft 365 review, AI governance design or fractional DPO support — that advisory work is what funds the practice. There is no funnel between the two: you can use every course, tool and template without ever speaking to us.