GDPR, PCI & accessibility
Audits and fixes for the rules your website has to meet, with the evidence written up so you can show it to auditors, trustees or procurement. I handle the technical side; your data protection lead, assessor or legal adviser makes the policy decisions, and I give them what they need.
engagement: Audit, then fixed-price remediation covers: UK GDPR, PCI DSS, WCAG 2.2 AA output: Findings, fixes and an evidence pack note: Technical work, not legal advice
Sounds familiar?
- Forms collect more than they need, and old submissions are never deleted
- Answering a subject access request means days of manual searching
- Card details pass through your own server
- Procurement or trustees have asked for an accessibility statement
- You're a public sector body that must meet WCAG 2.2 AA
The work, in detail.
UK GDPR in forms
Consent where it's needed, only the fields you need, and retention rules that delete old submissions automatically.
Subject access request exports
Tools to find and export everything the site holds about a person, so requests can be answered on time.
PCI DSS hosted payment fields
Card details captured by your payment provider's hosted fields or pages, so they never touch your server. This can greatly reduce how much of your site is in PCI scope.
Security headers and hardening
Content Security Policy, HSTS and related headers, plus removal of anything that gives attackers an easy start.
WCAG 2.2 AA audits and remediation
Automated scans plus manual keyboard and screen reader testing, then fixes in the theme, templates and components.
Accessibility statement drafting
A draft statement based on the audit findings, in the format public sector bodies are required to publish.
From first call to finished work.
Every engagement starts with a free 30-minute discovery call and a written proposal. Nothing starts until the scope, price and terms are agreed in writing.
Scope
We agree which rules apply and which parts of the site and its forms are covered.
Audit
I test and review the site, and write up the findings in order of risk.
Remediation
Fixes are made for a fixed price, tested on staging, and released.
Evidence and retest
A retest confirms the fixes, and the evidence pack records what was checked and changed.
Frequently asked.
Will this make my organisation GDPR compliant?
Not on its own. UK GDPR also covers your policies, contracts and how staff handle data. I fix and document the technical side; your data protection lead or legal adviser should sign off the policy decisions.
Which accessibility standard do you work to?
WCAG 2.2 level AA. It's the standard GOV.UK says public sector websites and apps must meet, and a sensible target for everyone else.
Do you carry out PCI DSS assessments?
No. I'm not a Qualified Security Assessor. I make the technical changes that reduce how much of your site is in scope, and give your assessor or payment provider the information they ask for.
Will you have access to personal data?
If the work means handling personal data, such as user accounts, form submissions or a copy of a live database, we sign a UK GDPR data processing agreement alongside the contract before I get access. Where I can, I work on copies with personal data removed.
Tell me what your site needs.
The first conversation is free and comes with no obligation. Tell me about your site and I'll come back with a written proposal.