Data protection that works in your business
Practical data protection support for a range of businesses
Straightforward data protection policies everyone understands
Engaging and memorable data protection training for your business
Advice on data protection you can action on the same day
Navigate Data Protection with absolute confidence
Over two decades of data protection expertise
External Data Protection Officer (DPO)
ICO plain English policy standard
Data protection support that delivers what you need
We remove the complexity of UK GDPR and the Data Protection Act 2018. Offering you a range of support options. Including a one-off audit, a full policy suite, staff training or acting as your external DPO.
External DPO Services
A named, accountable Data Protection Officer. Keeping up to date with the latest developments and how they impact your business. Available as your primary DPO or to support your in-house team.
Policies and Documentation
Privacy notices, Register of Processing Activities (ROPA), data retention schedules, Data Subject Access Request (DSAR), and much more. All drafted in plain English in line with the ICO’s transparency standard.
GDPR Training
Bespoke staff training that moves beyond any tick box compliance. Practical, online and face-to-face, straightforward sessions tailored to your sector, your risks and your team.
Audits and Gap Analysis
Know exactly where you stand with your compliance. We review your current situation against UK GDPR requirements and create a clear, prioritised action plan.
International Transfers
International Data Transfer Agreement (IDTA), Standard Contractual Clauses (SCC), transfer impact assessments and third-party adequacy. We navigate cross-border data flows for global businesses.
ISO 27001 Support
Combining information security management and your data protection compliance. Preparing for surveillance and certification audits.
Let’s make data protection work for you
Get in touch to learn more about how we can help your organisation
The ICO says it’s simple
So do we
The Information Commissioner’s Office has always been clear. Privacy notices and data protection policies must be written in plain language that your audience can genuinely understand. Legal phrasing and jargon are not a form of defence. They are barriers to compliance.
At PMA, we bring together data protection expertise and professional copywriting to produce documentation that works for your business and the regulator. That means your staff understand the training materials. Your customers make sense of the privacy notice.
- Privacy notices created to be easily read by anyone
- Staff policies that can be followed clearly
- Training content that resonates with the audience
- Data Processing Agreements (DPAs) and consent statements in business English
Why plain English matters in data protection
The law is clear. Article 5(1)(a) UK GDPR requires that personal data be processed transparently. The ICO has consistently interpreted that to mean information must be genuinely understandable, not just technically provided.
A privacy notice buried in legal phrasing is not transparent
A consent mechanism that confuses users does not produce valid consent. A data processing policy that staff cannot follow does not demonstrate accountability.
We write documentation that is clear, lawful and proportionate. Because the ICO requires all three.
Sector experience that adds value
Data protection compliance is not a one-size-fits-all. The obligations facing a fintech startup differ greatly from those of a healthcare charity or an SME. We bring sector-specific knowledge to every client scenario.
- Fintech and payments
- Open Banking
- Aviation and airlines
- Healthcare
- Legal services
- House builders
- Charities and Not for Profit
- Property and PropTech
- SMEs
- AI and technology
Are you prepared for the Data Use and Access Act (DUAA) 2025?
Get in touch to learn more about how we can help your organisation.