01
GDPR Compliance
Board-ready UK GDPR programmes: audits, gap analysis, data mapping, DPIAs and remediation delivered against a fixed scope.
Learn moreGovernance · Compliance · Trust
Building Trust
Through Governance.
Helping organisations achieve GDPR compliance, data protection excellence and information governance with quiet confidence — for the boards, regulators and clients that matter.
Frameworks & Standards We Work To
UK GDPR & DPA 2018
ISO/IEC 27701 : 2019
ISO 19650
NIS2 Directive
Cyber Essentials Plus
ICO Registered
UK GDPR & DPA 2018
ISO/IEC 27701 : 2019
ISO 19650
NIS2 Directive
Cyber Essentials Plus
ICO Registered
Services
Six disciplines. One standard of care.
Download our service brochure (PDF)
Every engagement is scoped, fixed-fee and led by a senior practitioner — the same person who signs the report also runs the workshop.
02
Data Protection Officer
Fractional and interim DPO retainers giving you senior expertise, without the fixed headcount or generalist compromise.
Learn more03
Information Governance
Frameworks aligned to ISO/IEC 27701 and ISO 19650, embedded across projects, supply chains and executive reporting.
Learn more04
Data Audits
Structured audits of records, systems and processing activities — surfacing risk, evidencing control, guiding investment.
Learn more05
Policy Development
Policies, notices and contracts written for how your firm actually operates — not templates copied from someone else's business.
Learn more06
Staff Training
Executive briefings and role-based training that turn regulation into muscle memory across your organisation.
Learn moreBy the numbers
Measured outcomes, not measured promises.
0%
GDPR Focus
Every engagement, every hour.
0h
Proposal Turnaround
From discovery call to fixed fee.
0%
Risk Reduction
Average close-out of high-severity items.
0+
Years' Experience
Senior practitioners on every retainer.
About Keystone
A boutique consultancy, built to the same standard as the firms we advise.
Keystone Governance was founded on a single principle: that information governance is a discipline of trust, not paperwork. We work with a small number of clients, at senior level, on the questions that keep their boards awake.
No offshore delivery teams. No PowerPoint theatre. Just measured, defensible advice from practitioners who have sat on both sides of the audit table.
- DiscoveryA 30-minute call to understand your firm, your projects, your risk.
- DiagnosisA structured audit against UK GDPR, ISO/IEC 27701 and ISO 19650.
- DesignA prioritised roadmap the board can approve and staff can execute.
- DeliveryImplementation and training, delivered by the same senior lead.
- DefenceRetained assurance, so what you built keeps working.
Why Keystone
The difference is who does the work.
Every mandate is delivered by the founding practitioners. We turn work away rather than dilute it.
vs. Big 4 advisory
Senior attention, without the pyramid.
The person you meet is the person who does the work. No dilution as engagements progress.
vs. Legal firms
Advice you can operationalise.
We translate regulation into policies, workflows and evidence — not memoranda that sit in a drawer.
vs. Generalist consultancies
Specialist depth on day one.
UK GDPR, ISO/IEC 27701 and ISO 19650 are our practice areas, not modules bolted onto a broader offer.
vs. In-house hire
Fractional cost, executive posture.
The bench of a consultancy, the accountability of an officer, at a fraction of the fully-loaded cost.
Client voice
Trusted by boards that don’t give trust lightly.
“Keystone Governance rebuilt our information governance from first principles. The board finally has a picture it can trust — and defend.”
Managing Director
Civil Engineering Consultancy · London
Civil Eng.
Rail
Contractors
Design
Consulting
Infrastructure
Free guide
GDPR for Civil Engineers
What UK data protection law actually requires of engineering firms — in plain English, with a ten-question self-assessment you can run this week.
Contact
Begin with a private conversation.
One 30-minute call. A tailored fixed-fee proposal within 48 hours. No obligation, no follow-up sequence — just clarity on where your firm stands and what would move it forward.
Keystone Governance Ltd
Registered in England & Wales · ICO Registered Controller
- Keystone Governance