Are you looking for a legal assessment, like a risk assessment, an impact assessment, a requirements assessment or a readiness assessment? The purpose of an assessment is for us to assess, evaluate or judge your organisation. We have years of experience doing various assessments on specific focus areas. We can also conduct a gap analysis or a compliance audit, but those are different types of services.

The benefits of an assessment

An assessment should:

  • set out where you currently stand,
  • give you insight into your organisation,
  • help identify and define the current reality, whatever that might be,
  • direct your improvement efforts or next steps, and
  • provide a measuring stick towards where you want to be.

An assessment answes the question. Where are we now?

Assessments that we offer

We have experience conducting assessments (both face-to-face and online) on specific topics. Below is a list of some of the assessments we offer.

Artificial Intelligence assessments

  1. Fundamental Rights Impact Assessment (FRIA) to evaluate how high-risk AI systems might affect individual rights before deployment. It identifies risks to privacy, non-discrimination, and fairness and implements mitigation measures such as human oversight and data governance. The EU AI Act requires some organisations to conduct these.
  2. AI Impact Assessment (AIIA) to identify, assess and manage AI use case impacts and risks against relevant AI regulations to ensure effective AI governance. Some people call this an AI Risk Assessment. This is the equivalent
  3. AI Governance Maturity Assessment to evaluate your governance maturity, policies and policy framework, and technical controls, and identify the gaps that must be addressed before deploying AI at scale.
  4. AI Vendor Impact Assessment to evaluate the risk profile of third-party AI vendors or external AI tools, scrutinise their data handling practices and audit trails, and identify contractual gaps that expose your organisation to risk or liability.
  5. AI Incident Assessment triggered by a system failure, complaint, or regulatory inquiry to establish what went wrong, identify root causes, and define the remediation steps required.
  6. Algorithmic Impact Assessment to evaluate whether an AI system is appropriate for its intended decision-making context, examine data quality and oversight mechanisms, and document findings for regulatory purposes.

Since AI and data are intrinsically linked, the assessments below that detail data protection assessments may also apply to AI projects where personal information is also involved.

Data protection assessments

  1. Organisational impact assessment to assess the high-level impact of applicable data protection laws on your organisation and evaluate the best way forward.
  2. Privacy impact assessment (PIA) to assess the impact of your activities (or products or services) on the privacy or personal information of data subjects. Some people refer to this as a privacy risk assessment. In South Africa, they are referred to as Personal Information Impact Assessments (PIIA), while in the EU they are known as Data Protection Impact Assessments (DPIA). They are all the same thing.
  3. Vendor or third-party risk assessment to assess the risks relating to the use of third parties (sometimes referred to as vendors, suppliers, partners, contractors, or service providers).
  4. Data protection responsibility assessment to determine whether or not you are responsible for protecting personal data that is being processed.
  5. Consents, Disclosures, and Signatures Assessment to assess whether you are using electronic consents, disclosures, and signatures correctly to reach agreement with your customers, suppliers, or employees electronically.
  6. Data Protection Readiness Assessment to assess how ready you are for the commencement of a law or to start your compliance programme.
  7. Microsoft SSPA Independent Assessment to independently assess whether your organisation (which is a supplier to Microsoft and processes personal data for it) complies with the Microsoft Supplier Data Protection Requirements (DPR).
  8. Processor assessment to independently assess whether a processor for a controller complies with the contract between them.
  9. Country adequacy assessment to independently assess whether a country has adequate data protection in place so that, together with the standard contractual clauses (SCC), a data exporter can transfer personal data to a data importer in another country.
  10. Legitimate interest assessment (LIA) to assess and demonstrate that you can process personal data based on your legitimate interests. We conduct LIAs for organisations, and we can empower you to conduct LIAs through the relevant module in our programme.
  11. Prior authorisation assessment (PAA) to assess and demonstrate whether you do or don’t need to get prior authorisation.
  12. Transfer impact assessment (TIA) to assess whether a transfer to another country is lawful because the controller adequately protects the personal data it is transferring by putting sufficient measures in place.

There are various data protection self-assessments that you can do on the ICO website and the Information Regulator’s eServices portal.

Other types of assessments

  1. IT Contracts Assessment (to assess whether you are drafting, negotiating, and concluding IT contracts effectively)
  2. Requirements Assessment (to accurately identify what legal solutions you need)
  3. IT Legal Compliance Assessment (to assess the degree to which your organisation complies with IT laws)
  4. Electronic Signature Assessment (to find out whether you’re ready to go paperless or not)
  5. Information Security Assessment (to know at a high level your current level of information security and what you still need to do to comply with the relevant laws)
  6. Legal Risk Assessment (to assess what the most likely legal risk is for you)
  7. Equal Pay Diagnosis and Assessment (to diagnose your specific business structure and needs and ensure that your business receives true value for what your employees are paid)
  8. Cybercrimes organisational impact assessment (to assess the high-level impact of applicable cybercrimes laws on your organisation and evaluate the best way forward)

An assessment focuses on where your organisation is at a point in time.