The regulator and auditor view: every customer answers to someone
Colleges, privacy commissioners, law societies, standards bodies and assessors do not use SurroundNet. They inspect the organisations that do, and they ask for the same kinds of proof about the digital estate. SurroundNet’s job is to have that proof ready, from live records.
An illustrative view: the questions an auditor or regulator typically asks of a health, legal, pharmacy or card-taking business. Guidance for your privacy officer or counsel — not legal advice.What SurroundNet answers today
Marked plainly: what works today, and what is coming next.
Which obligations apply here?
Worked out from where you operate (your site addresses) and your industry. The general privacy and business obligations always apply; sector and provincial ones are added for you.
Who can see what, and does everyone sign in as themselves?
Roles and access by need, per organisation and site; individual accounts; two-factor sign-in for administrators.
Who looked at or changed this record?
An audit trail of who did what and when.
Where is the evidence for each control?
Each control shows its status from evidence. Technical controls are checked against the platform; organisational ones are signed off by a named person. “Action” means your own records do not show the control yet; “Gap” means the platform itself cannot prove it — the two are kept apart.
How would you know about a breach, and who did you tell?
Breach reconstruction from the record, and a notification clock driven by the classes of data involved.
Are your people trained and certified?
Staff certification programmes: questions answered, assessed, then approved by a different person, issuing a credential with an expiry. Outside credentials are verified before approval.
Can you hand the records over?
Export to the regulator, or to the next provider at the end of a contract; provable deletion when data must go.
From first conversation to source of truth
- Talk to us with your compliance leadBring the framework or inspection you are preparing for.
- Confirm your profileWhere you operate and your industry decide which obligations apply.
- Work the Action itemsSign off what is organisational; evidence what is technical.
- Keep it currentThe evidence is produced as you run, not assembled the week before.
Auditors and compliance advisers who see the value can introduce their clients — with their clients’ consent.