Who it is for
A proportionate engagement with clear boundaries.
Technology SMEs that need a proportionate PIMS while retaining responsibility for privacy decisions, risks and processing activities.
Advisory & readiness
PIMS implementation support
A staged programme aligned to ISO/IEC 27701:2025 to build privacy governance, risk treatment and evidence-producing processes your organisation can operate.
ISMS operating modelFrom policy to practice
Acceptance and competence boundary
Acceptance is subject to a documented review of privacy-management competence, capacity, processing context, relevant jurisdictions and any need for legal or specialist input. Mang Morgan does not provide legal advice; an engagement may require an approved specialist or be declined if the required competence or independence cannot be demonstrated.
What is included
- Context, scope and processing-role workshops
- Privacy-risk and obligation method
- Policy and procedure tailoring
- PII lifecycle and accountability process design
- Evidence and governance cadence
- Internal capability transfer
Typical outputs
- Tailored PIMS framework
- Privacy policy and procedure set
- Privacy-risk and processing registers
- Implementation roadmap
- Operating guidance
What we need from you
- Business model and processing context
- PII inventories and data flows
- Existing privacy and security practices
- Named process owners and leadership participation
Timing
Phased after discovery; the programme plan depends on processing complexity, existing maturity, jurisdictions and team availability.
Pricing basis
Phased fixed-fee or time-based support, with assumptions and change-control triggers stated for each stage.
Important exclusions
- Acting as legal counsel or data protection officer
- Owning privacy risks or management decisions
- Certification
- Independent audit of Mang Morgan’s own implementation work without safeguards
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.