Home / Sectors
The Act applies to everyone. What reasonable looks like changes by sector.
A fifteen person clinic and a fifteen person product team hold varying quantities of personal data and will face completely different problems with it. These pages set out where the data usually sits in each sector, what tends to need attention, and which parts of the engagement do the most work.
Pick the closest match
Banking, lending and insurance
Lending and insurance businesses already carry regulatory obligations, which usually means some controls exist. The gap is rarely that nothing is documented. It is that what is documented was built for a different regulator, with a different purpose, and nobody has mapped it across.
Healthcare and diagnostics
Health data carries the highest consequence if it is exposed, and healthcare businesses tend to run on the widest spread of systems. A single clinic can touch six places a patient record lives before lunch.
Retail and direct to consumer
Retail is the sector where the volume of personal data is highest and the controls are usually thinnest, because everything was built for growth and nothing was built for deletion.
Software and app companies
Software companies usually have the best technical controls and the worst documentation. The access policy exists in someone's head, the logging captures far more than anyone intended, and the vendor list has never been written down.
Education and training
Education is the one sector where the rules are meaningfully stricter, because most of the people whose data you hold are children, and the law treats that differently.
Professional services and agencies
Service businesses hold other people's data as a by-product of doing the work. There is rarely a database at the centre of it. There is email, a drive, a few spreadsheets and a lot of WhatsApp.
Your business will not match any of these exactly, and that is the point. The engagement is shaped around what you actually run, not around a template of what a business in your sector is assumed to have. If none of these fit, say so on the first call and we will work from your systems instead.
Not sure which of these you are?
Most businesses sit across two. Tell us what you run on and we will work it out on the call.