MICHVI Privacy Governance Assessment
An independent advisory assessment of how an organisation governs personal-data processing, privacy accountability and operational controls.
The Question
Responsibility for personal data is often spread across legal, compliance, security, marketing, product and vendor management.
Records of processing, notices, consent settings, retention schedules and vendor terms may each exist. It can still be unclear whether, together, they show how processing is actually governed, and who is accountable where they do not agree.
Who It Is For
Leaders accountable for how their organisation governs personal data:
- Data Protection Officers
- Heads of Privacy
- Legal
- Compliance
- Chief Information Security Officers
Assessment Areas
- Processing activities
- Lawful basis
- Consent governance
- Retention
- Vendor oversight
- Data-subject rights
- Accountability and remediation
Why It Matters
The question tends to surface when governance has to be shown rather than assumed: a board or audit-committee question, a supervisory enquiry, a customer or partner due-diligence request, a data-subject complaint, or a transaction.
At that point the question is not only whether controls exist, but whether the organisation can demonstrate how they are governed.
Common Prompts
- Board, audit or leadership request
- Regulatory or supervisory expectation
- New processing, product or vendor change
- Data-subject rights or complaint volume
- Internal review or remediation planning
- Merger, acquisition or reorganisation
Scope
Scope is agreed during scoping. No client credentials are requested by default.
Fee
The fee is confirmed during scoping.
What to Expect
Scoping request
You indicate what prompted the request and the areas of concern.
Scoping conversation
The governance question, the areas in scope and what evidence can be shared without client credentials are clarified.
Written proposal
Scope, fee, terms and the independence disclosure, in writing.
Assessment delivery
Delivered within the period agreed in writing.
Walkthrough
A walkthrough of the findings with those who commissioned the assessment.
PGA and the Evidence Assessment
MICHVI Privacy Governance Assessment
An independent advisory assessment of how an organisation governs personal-data processing, privacy accountability and operational controls.
For privacy, legal, compliance and security leadership.
MICHVI Evidence Assessment
An independent assessment of the evidence being relied upon for a defined consequential decision.
For marketing and finance leadership. About the Evidence Assessment →
What It Is Not
- Not a privacy certification.
- Not a guarantee of regulatory compliance.
- Not legal advice or a legal opinion.
- Not a replacement for a statutory Data Protection Officer.
- Not penetration testing.
- Not a cybersecurity certification.
- Not a statutory audit or a formal assurance engagement.
Questions
- Is this a compliance audit or a certification?
- No. The Privacy Governance Assessment is an independent advisory assessment. It does not certify the organisation, does not guarantee regulatory compliance, and is not a statutory audit or a formal assurance engagement.
- Is this legal advice?
- No. The Privacy Governance Assessment does not provide legal advice or a legal opinion.
- Can MICHVI act as our Data Protection Officer?
- No. The Privacy Governance Assessment is not a replacement for a statutory Data Protection Officer.
- Does it include security testing?
- No. The Privacy Governance Assessment is not penetration testing and is not a cybersecurity certification.
- Do you need access to our systems?
- Not by default. No client credentials are requested by default. The evidence to be shared is agreed during scoping.
- How is the fee set?
- The fee is confirmed during scoping.
- How is this different from the MICHVI Evidence Assessment?
- The Evidence Assessment examines the evidence being relied upon for a defined consequential decision, typically for marketing and finance leadership. The Privacy Governance Assessment examines how an organisation governs personal-data processing, privacy accountability and operational controls, for privacy, legal, compliance and security leadership.
Who Stands Behind the Assessment
Ashok Kumar Jha
Founder & Senior Governance Advisor
Retired Senior Officer, Bihar Administrative Service, with approximately three decades of public service across administrative systems, institutional oversight and public accountability.
Published Research
- Digital Signal Governance: A Foundational Framework for the Signal Layer of Digital Systems. Shikhar Jha. SSRN working paper, 2026. doi:10.2139/ssrn.7146702
- Digital Signal Governance (DSG): Conceptual Framework Repository. Shikhar Jha. Zenodo, 2026. doi:10.5281/zenodo.20611372
- The Changing Governance in India. Ashok Kumar Jha and Shikhar Jha. SSRN working paper, 2026. doi:10.2139/ssrn.7271626
Open technical contributions: Evidence Rail, Deletion Evidence and Basisline, published at github.com/michvi-open.
Privacy Governance Assessment
Describe the privacy governance question your organisation needs examined.
Advisory only. Scope and fee confirmed during scoping. No client credentials by default.