Show them the evidence,
not the intentions.
We help organisations get into line with the standards that govern them, whether that is Uganda's Personal Data Protection Office, an international framework such as ISO 27001 or SOC 2, or both at once. Uganda's PDPO has moved from registration to enforcement, with penalties at two percent of annual turnover and an annual compliance report due every year. Our clients are audited against ISO standards, PCI DSS and GDPR just as often, and the evidence they need is the same evidence either way.
- 2%of turnover, the corporate penalty ceiling
- 24international frameworks we map to
Almost every organisation you would think of
If you collect customer records, staff files, beneficiary data, guest registrations, biometric attendance, or run any system that captures identifiable people, the obligation is already yours. These are the organisations we already do that work for.
Banks & MFIs
Mobile Money & Telcos
SACCOs & Credit Unions
NGOs & Multi-Site
Healthcare
Schools & Campuses
Hotels & Hospitality
Retail & POS
Professional Firms
Labs & Studios
Not sure which of these you fall into? That is what the first five minutes are for.
Talk to an engineer
Evidence, numbered and traceable
Every artefact we hand over carries a reference. Hardware serial numbers, software versions, configuration states, the test that was run and the result it produced. When an auditor asks which server, which build and which check, the answer is a lookup rather than an argument.
Five artefacts the process asks for
Every framework, local or international, asks for the same underlying proof. We produce it from your live systems: the technical evidence. Your lawyer interprets the law, your auditor reads the reports. That division of work is deliberate, and it is why we hand over artefacts an auditor accepts rather than opinions.
Data map
What personal data you hold, where it sits, who can reach it, how long you keep it, and how it is actually deleted. A spreadsheet, not a project, but it must be current.
Access review records
A dated, signed list of who can reach HR, finance, production and customer systems, with leavers removed and the removal evidenced by date.
Configuration evidence
Screenshots and exports proving MFA is on, retention is set, backups are encrypted, guest Wi-Fi is segmented, and database grants are not blanket-ALL.
Vendor documentation
What each software and infrastructure supplier does with your data, where it is hosted, and what your contract says about breaches and cross-border transfer.
Incident plan, practised
Who to call, how to preserve logs before remediation, how to assess impact, and who notifies the regulator and the data subjects. Tested at least once, not just written.
The numbers we test against
These are the measurable requirements that turn a claim into evidence. Most organisations have never had anyone check them against live systems.
| Requirement | Threshold |
|---|---|
| Backup frequency | Daily |
| Backup storage | Geographically separate |
| Recovery testing | At least quarterly |
| Log retention | Minimum 1 year |
| Server room access | Biometric + physical token |
| Data / power cable separation | At least 300 mm |
| Server room temperature | 18–24 °C |
| Server room humidity | 40–60 % RH |
| Administrative access | MFA mandatory |
| Network zoning | DMZ / internal / server / management |
| Incident plan test | Annually |
These are the physical and logical requirements set out by NITA-U, alongside the Uganda Data Protection and Privacy Act 2019 and the annual reporting cycle operated by the Personal Data Protection Office.
The same evidence, mapped to your framework
Uganda's NITA-U and PDPO requirements are our baseline. But most of the organisations we serve are audited against international frameworks, and some of our clients operate entirely outside Uganda. We gather the evidence once, then map it to whichever framework applies where you are. If you are working towards certification, we will happily run the gap analysis that tells you exactly how far you are from it.
Security & privacy management
- ISO/IEC 27001:2022 Information security management systems
- ISO/IEC 27002:2022 Security control catalogue
- ISO/IEC 27701:2025 Privacy information management. Standalone PIMS since Oct 2025.
- ISO/IEC 27017 Security controls for service providers
- ISO/IEC 27018 Protection of personal data in third-party services
- ISO/IEC 42001:2023 Artificial intelligence management system
Risk, resilience & service management
- ISO 22301:2019 Business continuity management systems
- ISO 31000:2018 Risk management guidelines
- ISO 27031:2011 ICT readiness for business continuity
- ISO/IEC 20000-1:2018 IT service management systems
- NIST CSF 2.0 Cybersecurity framework
- CIS Controls v8.1 Prioritised safeguard catalogue
Payments, security & audit
- PCI DSS v4.0.1 Cardholder data. Sole active version since Mar 2024.
- SOC 2 AICPA trust services criteria
- ISO/IEC 20000-1:2018 Service level and incident management
- NIST SP 800-53 Security control catalogue
- ISO/IEC 38500:2024 Governance of IT for the board
- ISO/IEC 27010:2022 Audit and assurance processes
Built environment, product & web
- ISO 19650-1:2018 Building information modelling. 3D and as-built deliverables.
- ISO/IEC 40500:2025 WCAG 2.2, now an ISO standard
- OWASP ASVS v5 Application security verification standard
- ISO/IEC 25010:2023 Software product quality model
- IEC 62443 Security for industrial control and SCADA systems
- ISO/IEC 11801 Generic cabling for customer premises
Which framework applies to you
| Where you operate | Framework that governs | What we produce |
|---|---|---|
| Uganda | Data Protection and Privacy Act 2019 · NITA-U standards · PDPO registration and annual report | Full evidence pack |
| Kenya | Data Protection Act 2019 · ODPC registration · DPIA 60 days ahead of high-risk processing | Evidence pack and DPIA support |
| Tanzania | Personal Data Protection Act 2022 · PDPC transfer permits | Evidence pack and transfer permit support |
| European Union and UK | GDPR · UK GDPR · NIS2 | Records of processing, DPIA, transfer register |
| Nigeria, South Africa, Rwanda | NDPA 2023 · POPIA · Rwanda data protection law | Residency and cross-border transfer evidence |
| Audited globally | ISO 27001, 27701, 22301, SOC 2, PCI DSS, CIS Controls | Control mapping, gap report, remediation plan |
“We work to the current published edition of every standard referenced here. Where a client has no certification requirement, we still use the same control set internally, because it is the shortest route to evidence that holds up in an audit. Most engagements start with the free five-minute consult, where we tell you which frameworks actually apply to you and what the realistic path to compliance looks like.”
What the building does
- Server room access and biometric controls
- Data / power cable separation and containment
- Temperature, humidity and environmental monitoring
- Redundant power, RAID and UPS runtime
- Camera retention, signage and export permissions
What the systems do
- MFA on administrative and restricted access
- Role-based grants without blanket privileges
- Automated retention and secure disposal
- Backup encryption and restore verification
- Audit logging, one-year retention, tamper protection
Some suppliers take one column and leave the other to you. We audit both, because the regulator reads the whole page.