How DPP Helped Progeny Build a Mature Data Protection and Information Governance Framework

The Challenge

DPP’s engagement with Progeny has centred on establishing and maturing Progeny’s data protection and information governance framework across the Asset and Wealth Management businesses.

What DPP Did

DPP has undertaken a large-scale data mapping project to identify processing activities, data flows, retention requirements, security measures, international transfers and lawful bases for processing. Detailed workshops have taken place with Finance, HR, Marketing, IT, Estates Management, Strategic Operations, Digital and Advisory Services amongst other departments, from which a comprehensive and up to date Record of Processing Activities (ROPA, the internal log of what personal data an organisation holds and why) has been produced.

Alongside the data mapping programme, substantial advisory support has been provided in relation to information governance, privacy compliance and emerging technologies. This has included reviewing and enhancing key policies such as Progeny’s Data Retention and Destruction Standard, Data Classification Standard and DPIA Policy (Data Protection Impact Assessment Policy, the process for identifying and reducing privacy risk before a new project goes live), as well as providing specialist advice on proposed AI integrations to ensure risk management is embedded from the outset. This has involved assessing UK GDPR implications, international transfer considerations, DPIA requirements, staff guidance needs and wider regulatory obligations relevant to the financial services sector.

Additional support has also been provided on data subject rights processes, including SAR (Subject Access Request) and DSAR handling, redaction services, rights request procedures and governance documentation.

The Outcome

Establishing the ROPA has provided the foundation for wider governance initiatives, including the development of an organisation-wide retention schedule and information asset register, which are the focus of recent efforts. This work has helped Progeny continue to develop a more mature and operationalised privacy framework.

DPP continues to work closely with Progeny to mature its data protection and information governance frameworks and drive towards the highest standard of compliance and best practice.

“Mark is really invested in the role he provides as DPO and the Service Desk always reply promptly and with well reasoned responses.”

Martin Ankers, Progeny

Get in touch

If your organisation needs support building or maturing its data protection and information governance framework, DPP’s Outsourced DPO service can help.