If you’re looking for support in achieving compliance with the General Data Protection Regulation(GDPR) and other data protection-related legislation, and then maintaining it, URM’s GDPR consultants can provide you with a range of services as follows:

Virtual DPO Service

Enables you to access not just one, but a team of experienced and qualified data protection practitioners, each with their area of specialism, e.g., dealing with the regulator, i.e., the Information Commissioner’s Office (ICO), advising on challenging subject access requests (SARs), conducting data protection impact assessments (DPIAs), developing records of processing activities (ROPAs), managing personal data breaches, improving information security, developing awareness presentations, and transferring data to third countries using standard contract clauses (SCCs).

With our service, you can gain expert practical advice, guidance and support, as and when needed.  You can also ensure there is no ‘conflict of interest’ between the DPO and other business activities i.e., the DPO should not be a company director or HR representative.  You can also be confident of complying with the latest regulatory and legal developments, as URM’s Team closely monitors any clarifications/interpretations on the GDPR/DPA from sources such as the ICO.

  • Totally flexible arrangement with site (in person or remote) days delivered at a frequency set by you
  • Ad hoc guidance and advice on all aspects of data protection
  • Urgent response services for those time critical matters and issues
  • Annual GDPR auditing to provide assurance to key stakeholders.

For more detailed information on the contents of URM's Virtual DPO Service please refer to our data sheet.

Virtual DPO Service Data Sheet

Conducting a Gap Analysis

One of URM’s most popular services, is its 2 or 3-day high-level GDPR gap analysis which will assist you understand your current levels of GDPR compliance, identify gaps and vulnerabilities, and enable you to establish and implement a prioritised action plan.  The gap analysis can be conducted remotely or on site and typically involves interviews with pre-agreed personnel and a high-level documentation review.  URM will be looking to understand how you process personal data in each area of your business, the measures you have in place and also understand the relationship with third parties and contractual data protection requirements.  A RAG status diagram is often used to illustrate at a high level your GDPR compliance, and you will receive clear guidance on which gaps to prioritise in terms of remediation activity.

Remediation Support

Having completed a gap analysis on your organisation’s levels of GDPR compliance, URM can provide pragmatic and tailored support in addressing these gaps.  It may be in helping you develop an overarching data protection policy or in one or more of the supporting policies or processes surrounding data retention, data subject rights, third party (data processor) supplier management, and data breach management.  Or it may be helping you develop or refine your data retention schedules, privacy notices or your record of processing activities(ROPA).  Whatever your requirement, URM can help with all areas of your remediation plan.

Data Protection Impact Assessments (DPIAs)

A data protection impact assessment (DPIA) is a process to help you identify and minimise risks associated with processing personal data.  For many years, conducting DPIAs has long been considered a best practice activity, but has taken on greater significance with the GDPR where they are mandatory for any processing that is likely to result in a high risk to individuals.  Conducting DPIAs will also reduce the probability of data loss or breaching data subject rights and freedoms.  An effective DPIA can also bring broader compliance, financial and reputational benefits, helping you demonstrate accountability and building trust and engagement with individuals and should become standard practice in every organisation.  URM’s DP consultants are able to advise you on where you should be conducting DPIAs but, more importantly, how to conduct them and what the outputs should be, e.g., identifying and assessing risks to individuals taking into account both likelihood and severity of any risk, as well as identifying any additional measures to mitigate those risks.  URM’s team can also provide a review service to ensure you take the right actions.

Producing records of processing activities (ROPAs)

As seen with the mandatory requirement to conduct DPIAs, the GDPR is a heavily risk-based law.  However, many organisations are missing one of the best tools for identifying data risk in their processing, i.e., a record of processing activities (or ROPA), despite, currently, it being a statutory requirement for most organisations under Article 30.  In URM’s opinion a ROPA should be front and centre of any controller’s DP compliance effort.  URM has helped a number of organisations develop their ROPAs and once developed can help you identify not just the risky processing, but also the mitigating steps that can be taken to control those risks.  It’s worth remembering that the ROPA will be one of the first compliance documents requested by the regulator in the event of a data breach.

Data Subject Access Request (DSAR) Redaction Service

One of the areas which organisations often struggle with when dealing with DSAR redaction is understanding what legal exemptions are available and, more importantly, can be applied.  Deciding on which elements of a document need to be redacted and where exemptions can be applied is a timely process and one which requires a skilled interpretation of the UK GDPR.

URM can provide such skills through its knowledgeable and experienced Team and is able to apply the appropriate redactions to any documents supplied.  It should be noted that URM delivers a human, rather than an electronic solution, which is strongly believed to be more effective and appropriate.  As guided by the ICO, it’s essential to understand the context of a DSAR and this can only really be achieved where the raw material is read by a human eye.  Following the redaction service, URM is able to package the DSAR together for disclosure.  Furthermore, if required, URM is able to act as your representative with the UK regulator where a DSAR is contested.

See Client Feedback on URM DSAR Service

Training and Awareness

URM is very experienced at developing training and awareness material to cover personal data protection requirements and policy compliance for the whole organisation and can offer online training and assessment via URM’s portal (Alurna).  For more in-depth requirements, URM can provide the BCS Foundation Certificate in Data Protection training course which is aimed at providing your organisation’s DP specialists with a sound grounding and practical interpretation of the key elements of UK data protection law, including the UK GDPR and the UK Data Protection Act 2018.  URM also offers a tailored training service for specific activities, such as developing ROPAs and DPIA processes.

Why URM?


URM’s DP and GDPR consultants have extensive ‘real world’ experience as both practitioners and subject matter experts working at a senior level within business and in their data protection consulting roles advising organisations on best practice.  With a 17-yeartrack record assisting organisations to comply with legislation such as the Data Protection Act, the GDPR and local country-specific legislation, URM has earned a reputation for adopting a pragmatic and business appropriate approach.


A key differentiator between URM and other data protection service providers is our flexible service offerings.  Our virtual DPO service can be customised to your precise requirements, in terms of the type of support you require and the frequency of site days (remote or on site) etc. Equally, with our remediation support, URM can assist you address any gaps identified and achieve full GDPR compliance. We can also help you maintain that compliance with GDPR auditing services.


URM prides itself on its knowledge transfer philosophy and training expertise which helps to ensure that you not only understand what the principles and requirements of the GDPR are but how to best meet them.

Data Protection FAQGDPR FAQ

Who Needs a ROPA and Why?

Latest update:
3 May

Under the UK GDPR, the majority of organisations processing personal data are required to create and maintain a ROPAs

Read more
Thumbnail of the Blog Illustration
Data Protection
How to Create a Record of Processing Activities (ROPA)

In this blog, we will outline a step-by-step procedure on how you can create a ROPA.

Read more
Thumbnail of the Blog Illustration
Data Protection
Chatbots and Personal Data: Benefits and Risks

This blog considers at high-level various possible legal ramifications of using Chatbots, especially ChatGPT, concerned with data protection risks.

Read more
Thumbnail of the Blog Illustration
Data Protection
Avoiding Email Data Security Breaches

For all of us, email can be both a blessing and a curse. On one hand you have the speed and convenience of communication....

Read more
URM were super helpful and knowledgeable, talking and walking me through each one of the tests and providing some useful information on security and how to improve things in the future.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.