When an expert is not an expert

I live in a beautiful 1930s house by the sea.  When we came for the first viewing I remember the estate agent saying – look at the original features!  I’ve since realised this is code for – a lot of work is needed!

As we didn’t know any local tradespeople a new contact kindly gave us some recommendations - electrician, builder, tiler, plasterer, plumber.

The last one still brings me out in a cold sweat because although the work seemed good, as time has gone by, we’ve realised we were ripped off.  And when you trust someone to provide you with a service because they’re the expert and you’re not and you pay them a lot of money for that service, it hurts when you find out they weren’t the expert they said they were.

Some of my clients have been through something similar with GDPR.  One recently told me that they’d paid £15,000 to a consultant to make their business compliant.  After carrying out their annual review, it was horrible to have to tell them that they weren’t actually meeting the required standards.

I know now that I should have done more to check that my plumber was qualified.  In my own field of expertise I’ve worked hard to make sure I’m properly qualified – and I’m very proud of my recent exam success with the International Association of Privacy Professionals (IAPP.org).

So using that expertise here are 7 questions that I suggest you ask your GDPR consultant.

1. How many years’ experience do you have as a Privacy/GDPR practitioner?


2. How do you keep up to date with changes in legislation?


3. Do you carry out reviews and audits of existing data processes?


4. Do you tailor your documents for each business or issue a set of templates?


5. Have you responded to a Data Subject Access Request or managed a data breach?


6. Do you perform reviews and carry out due diligence on suppliers or contractors?


7. Do you support managers and employees with understanding data protection so they meet the required standards?