California privacy operations guide
A source-backed operating map for California privacy risk assessments, consumer requests and DROP readiness.
Compliance operations guides
Start with the job in front of you. Each guide turns current official material into a bounded operating record without pretending to make the final legal or risk decision.
Choose the operating area
Each guide explains a bounded operational task and links to the official material used in its review.
California privacy operations
- Read guide
- Read guide
CCPA risk assessment evidence checklist
The facts, controls and decision records needed for a reviewable California privacy risk assessment.
- Read guide
California DROP readiness checklist
A practical evidence checklist for the California Delete Request and Opt-out Platform route.
- Read guide
How to keep a California privacy request deadline record
How to preserve receipt, verification, routing, deadlines and delivery evidence for a California privacy request.
US AI governance operations
- Read guide
US AI governance operations guide
A practical operating model for AI inventory, supplier review and accountable AI decisions using NIST sources.
- Read guide
AI system inventory minimum fields
The minimum fields that make an AI system inventory usable for ownership, risk review and change control.
- Read guide
AI vendor due diligence evidence checklist
Evidence to collect before relying on an AI supplier for a material organisational use case.
- Read guide
How to write an AI governance decision record
A repeatable structure for recording an AI approval, restriction, monitoring decision or stop decision.
US financial crime data operations
- Read guide
US financial crime data operations guide
A source-backed operating map for KYC remediation and official sanctions data handling.
- Read guide
KYC remediation data quality checklist
A practical checklist for finding incomplete, stale and contradictory KYC records without automating the risk decision.
- Read guide
OFAC sanctions file integrity and hashing
How to record an OFAC source file, verify its digest and preserve a reproducible normalisation run.
- Read guide
Sanctions normalisation is not sanctions screening
The operational boundary between restructuring official list data and deciding whether a customer or transaction matches.
UK data protection complaints
- Read guide
UK data protection complaints procedure requirements
A practical explanation of the UK duties to facilitate, acknowledge, investigate and record data protection complaints.
- Read guide
How the 30-day complaint acknowledgement period is calculated
How to calculate and record the UK data protection complaint acknowledgement deadline, including weekends and public holidays.
- Read guide
Data protection complaint versus data rights request
How to distinguish a UK data protection complaint from a data rights request and handle a message that contains both.
- Read guide
What a data protection complaints register should contain
A practical field list for a UK data protection complaints register, case chronology and evidence record.
- Read guide
How to publish an accessible data protection complaints procedure
Practical steps for publishing a clear, accessible UK data protection complaints procedure and complaint form.