Home / Sectors / Professional services
Service businesses hold other people's data as a by-product of doing the work. There is rarely a database at the centre of it. There is email, a drive, a few spreadsheets and a lot of WhatsApp.
The Act applies to every organisation that holds personal data. What reasonable looks like changes a great deal by sector, and this is what it changes to here.
What makes this sector different
Agencies, consultancies, recruiters, accountancy practices, law firms and other professional businesses hold client records, candidate details, identity documents, signed contracts and years of correspondence. Much of it concerns people who are not your clients at all, such as your client's own customers or candidates you never placed.
Because there is no single system, there is usually no single answer to where anything is. That makes discovery the step that does the most work here, and it is almost always the first time anyone has written the full picture down.
Where personal data usually sits
Drawn from engagements and from the questions that come up most often on first calls in this sector.
| System | What it holds | What usually needs attention |
|---|---|---|
| Email and shared drives | Client records, proposals, identity documents, signed contracts | Former staff retain access, and nothing is ever deleted |
| Client conversations, documents clients sent, group coordination | Business data sits on personal phones with no record or control | |
| CRM or spreadsheet | Leads, enquiry forms, call notes, follow-up history | Leads collected years ago still contacted, with no basis recorded |
| Candidate or client files | Data about people who are not your direct clients | No notice was ever given to the people the data is about |
| Subcontractors and freelancers | Client data handled by people outside your payroll | Contracts cover fees and delivery, and say nothing about data |
| HR and payroll | Employee records, bank details, identity proofs, attendance | No retention rule, so leavers' records stay live indefinitely |
What we look at first here
Client data on personal devices. Convenient during a deadline, invisible afterwards, and usually outside every control you have.
Offboarding that misses things. The laptop and the email account get handled. The shared drive, the WhatsApp group, the analytics dashboard and the client portal do not.
Data about people who never contacted you. Candidates, your client's customers, references. They have rights, and they were never told you hold anything.
Subcontractors without data terms. If a freelancer handles client data on your behalf, you answer for what happens to it.
Your own clients asking you about this. Increasingly common in tenders, and a clear answer wins work.
Which steps carry the most weight
The full sequence is on the engagement page. In this sector, these three usually do the heavy lifting.
Discovery and mapping
The whole value of the engagement often sits here, because nobody has ever listed where client data actually lives.
Compliance Support
A notice for the people whose data you hold, data terms for subcontractor agreements, a retention rule that finally closes old matters, and an offboarding checklist that covers everything.
Training, assurance and close out
Behaviour change matters more than technology in this sector. Most of the risk is in habits, not systems.
If your clients are starting to ask how you handle their data, this engagement produces the answer as a by-product. The evidence pack is exactly what a procurement questionnaire asks for.
Not quite your business?
Every engagement is scoped to what you actually run, so none of these pages will match you exactly.
Thirty minutes, and you will know where you stand.
Tell us what your business runs on. We will tell you which gaps matter most, whether or not you engage us.