Privacy Consulting

We build privacy programs that meet GDPR, CCPA/CPRA, state privacy laws and HIPAA, and that your teams can run day to day.

Get Started

Who this is for

Privacy obligations follow the data and the people it describes, not the size of the company.

  • You process personal data of EU or UK residents and need a defensible GDPR program.
  • You collect data from California residents or residents of other states with comprehensive privacy laws and must honor consumer rights requests.
  • You are a healthcare provider, health plan or business associate that must comply with the HIPAA Privacy, Security and Breach Notification Rules.
  • An enterprise customer, investor or acquirer has sent a privacy questionnaire that you cannot answer with confidence.
  • You are launching a product that uses new data sources, analytics or AI, and need a privacy impact assessment before release.

What's included

We scope privacy work around the laws that apply to you and the data you actually hold.

  • Applicability analysis

    We determine which laws reach you based on where your data subjects live, what data you collect and what your role is, controller or processor.

  • Data mapping and RoPA

    We trace personal data through your systems and vendors and build a record of processing activities (RoPA) that holds up to a regulator's request.

  • Privacy gap assessment

    We compare your current practices against each applicable law and rank the gaps by legal exposure and effort to close.

  • DPIAs and privacy impact assessments

    We run data protection impact assessments for high-risk processing and document the risks and mitigations.

  • Consumer rights and DSAR process

    We design intake, identity verification, fulfillment and response workflows for access, deletion, correction and opt-out requests.

  • Notices, consent and vendor terms

    We review privacy notices, cookie and consent mechanisms, and data processing agreements for the gaps that draw complaints.

  • Breach response planning

    We build notification procedures that match the timelines in GDPR, state breach laws and the HIPAA Breach Notification Rule.

  • HIPAA privacy program support

    We assess policies, workforce training, minimum necessary practices and business associate arrangements.

How an engagement works

A first-time privacy program typically takes 8 to 14 weeks to stand up. Focused work, such as a single DPIA or DSAR process, can run in 2 to 4 weeks.

  1. Scope and applicability

    We confirm the laws that apply, the business units in scope and the data categories you handle.

    Typically 1 to 2 weeks

  2. Discovery and data mapping

    We interview process owners, review systems and vendors, and build the data inventory and RoPA.

    Typically 2 to 4 weeks

  3. Gap assessment

    We test your practices against each requirement and deliver a prioritized register of gaps.

    Typically 2 to 3 weeks

  4. Program build

    We draft policies, notices, DSAR procedures, DPIA templates and vendor requirements, and we adapt them to the way your teams already work.

    Typically 3 to 5 weeks

  5. Rollout and handover

    We train owners, test the DSAR and breach procedures with a tabletop exercise, and hand the program to your team with a maintenance calendar.

    Typically 1 to 2 weeks

What you receive

  • An applicability memo that states which privacy laws apply and why.
  • A data inventory and record of processing activities (RoPA).
  • A privacy gap assessment with a prioritized remediation roadmap.
  • Completed DPIAs for the processing activities in scope.
  • A consumer rights and DSAR playbook with request templates and response timelines.
  • Privacy policies, public notices and a vendor data protection requirements checklist.
  • A breach notification procedure and a tabletop exercise report.

Frameworks and standards

  • General Data Protection Regulation (GDPR) and UK GDPR
  • California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA)
  • State comprehensive privacy laws across the United States
  • HIPAA Privacy, Security and Breach Notification Rules
  • NIST Privacy Framework
  • ISO/IEC 27701 privacy information management
  • EU AI Act and NIST AI RMF 1.0, where AI processes personal data

Why Velero

  • Security and privacy together

    Privacy commitments depend on technical controls. We assess both, so your notices describe what your systems really do.

  • Practical programs

    We design procedures sized to your team and your data, and we avoid templates that look complete on paper but no one follows.

  • Senior-led, plain English

    Experienced advisors lead the work, explain each requirement without legalese and work alongside your counsel on questions of legal interpretation.

FAQCommon questions

Do we need to comply with GDPR if we are a U.S. company?

Yes, if you offer goods or services to people in the EU or UK, or monitor their behavior. Location of the company does not decide it. We assess your data subjects and activities to confirm whether GDPR applies.

What is the difference between GDPR and CCPA/CPRA?

GDPR requires a legal basis for processing and applies to the personal data of people in the EU and UK. CCPA, as amended by CPRA, gives California residents rights to know, delete, correct and opt out of the sale or sharing of their data. The two overlap in many controls but differ in scope, definitions and enforcement.

Is there a HIPAA certification?

No. HIPAA has no official certification. Organizations are assessed against the Security, Privacy and Breach Notification Rules, and we prepare you for that assessment by testing your practices against each rule.

What is a DPIA and when do we need one?

A data protection impact assessment documents the risks of a processing activity and the steps that reduce them. GDPR requires one for high-risk processing, such as large-scale sensitive data, profiling or systematic monitoring. Several U.S. state laws require similar assessments.

Do you provide legal advice?

We provide privacy program, risk and compliance advisory. For questions that call for a legal opinion, we work alongside your attorneys and give them the facts and analysis they need.

Related servicesExplore related services

Let's talkReady to secure your business?

Tell us what you're working toward and we'll get back to you within one business day.

Schedule a call