Hire the Best Data Protection Specialists

If you need clarity, proof, or answers in a digital situation, I help you get them, fast, accurate, and legally defensible. Clients hire me when they need to verify evidence, identify who’s really behind an online identity, or understand exactly what happened in a digital incident. With 20+ years of investigative experience in both the public and private sector, and certifications in digital forensic analysis, digital forensics, and security (GCFA, GCFE, CISSP, CISM), I provide investigations that hold up under scrutiny. What I deliver: • Evidence verification to confirm whether files, emails, documents, or messages are authentic or manipulated • Deep OSINT investigations that reveal hidden links, patterns, identities, and digital footprints • Digital forensic investigation and compromise analysis that explain the “what, how, and who” behind an event • Court-ready forensic reports built on proper chain-of-custody and clear, defensible methodology • Online identity investigation when you need to know who is behind an account or digital activity All work is done legally, ethically, and confidentially. If you need reliable answers, verified evidence, and a specialist who can translate complex digital findings into clear conclusions, I deliver exactly that.

On-demand Legal Counsel (UK/EU) helping startups establish GDPR, DPA and SaaS compliance frameworks for scalable and investor-ready growth. From GDPR frameworks to SaaS and shareholder agreements, I deliver clear, investor-ready legal packages that protect founders, support funding, and enable long-term growth across the UK, EU, and US. What I deliver: -Privacy Policies & Cookie Notices (GDPR, CCPA, UK DPA) -Data Processing Agreements (Google/Firebase & third-party integrations) -SaaS Agreements & Subscription Terms -AI Use Policies & Ethical AI Clauses -IP Licensing & Terms of Use -Grant-ready legal packages for startups -Shareholder & Founder Agreements -Employment & Contractor Agreements Expertise: -Contract Law | Startup Law | GDPR & Data Privacy | Intellectual Property -UK, EU & US law -SaaS, fintech, healthtech & digital platforms Why clients choose me: -Strategic legal partner — I build compliance systems, not just documents -Investor-ready — tailored for funding, grants, and partnerships -Clear, founder-friendly language — no jargon, only actionable solutions -Business-smart — legally safe, scalable, and practical -Async & efficient — no calls, fast turnaround, fixed-price packages No calls. No fluff. No hidden fees. Just precise, business-ready contracts and compliance that help your startup grow confidently.

🔒 You need security that actually works — not a report that says it does. The organisations I work with want to find the vulnerabilities that matter, fix them with confidence, and get on with growing their business without security becoming the thing that stops them. I have delivered over 1,000 commercial penetration tests across 27 years. Not side projects. Not internal assessments. Full mission-critical engagements for high street and investment banks, hedge funds, insurance firms, government departments, police, military, national infrastructure, retailers, law firms, airports and more. I led the security architecture for the Athens 2004 Olympics internet-facing systems. I was lead architect on the UK Cyber Essentials scheme at launch. I have published in commercial security press and guest lectured at universities. There is a difference between someone who does penetration testing and someone who has seen every flavour of environment, every attack pattern, and every way organisations deceive themselves about their security posture. That difference is what you are hiring. 🎯 Where can I help: 🗡️ Network & Infrastructure Penetration Testing — adversarial testing of internal and external infrastructure, finding exploitable exposures before an attacker does. 🌐 Application Penetration Testing — web application and API security testing against real attack patterns: authentication, authorisation, input handling and business logic flaws. ☁️ Microsoft 365 Security Assessment — Entra ID, Conditional Access, PIM, Intune, DLP, sensitivity labelling, Exchange Online and Defender for Office 365. 🔷 Azure Security Assessment — identity and access management, network controls, storage and key management, Defender for Cloud posture, and monitoring coverage. 🟢 Google Workspace, GCP & AWS Security Assessments — configuration and access control assessments across Google and Amazon cloud environments. 🏛️ Security Architecture and Risk Advisory — senior technical input on architecture decisions, control design and risk without a full engagement commitment. 👤 Every engagement is delivered directly by me — David Morgan, founder of Metis Security. No account management layer, no junior handoffs, no templated output. You work with the person conducting the analysis and writing the report. 📋 How I work is as important as what I find Every finding in my reports is one I will defend as genuinely material to your environment. No padding, no low-hanging fruit included to justify the fee, no default risk ratings copied from a scanner. If your context changes the risk, the rating reflects that. What you receive: ✅ A visually structured report with clear separation between executive summary, findings and remediation roadmap — written to be read by people who are not security specialists ✅ Risk ratings adjusted to your specific environment and context, not defaulted from a tool ✅ A prioritised remediation roadmap so your team knows exactly what to fix first and why it matters commercially ✅ Immediate escalation of any high-risk finding or schedule-affecting issue during the engagement — you are never waiting until the end to hear something important ✅ Daily status updates so you always know where the engagement stands ✅ A debrief call at close to walk through findings, answer questions and finalise the report before it is delivered CISSP | ISSAP | Microsoft Security certifications | 27 years If you need to know whether your environment is genuinely secure — not whether it looks configured — I am worth a conversation.

UK businesses face growing pressure to get data protection right, but hiring a full-time DPO isn't always practical. I step in as your dedicated outsourced DPO, giving you the expertise you need without the overhead. With over 10 years in data privacy, I've led GDPR compliance programmes from the ground up, most recently as Group Data Privacy Manager at Marston Holdings (1,000–5,000 employees), where I built the organisation's entire compliance framework when GDPR came into force in 2018. I currently serve as outsourced DPO for several clients across healthcare, enforcement, debt recovery, finance and sports/retail. Here's what I help clients with: • GDPR audits and gap assessments — finding where your biggest risks actually are • DPIAs — Data Protection Impact Assessments for new systems, processes, and products • Privacy policies, fair processing notices, and records of processing activities (RoPAs) • Data Subject Access Requests (DSARs) — handled correctly and on time • Incident response and ICO notifications • Ongoing DPO support — acting as your named DPO on a retainer basis • Body-worn video and CCTV governance frameworks • Staff training and building a culture of privacy across your organisation I work across sectors including healthcare, hospitality, sports, and financial services. Whether you need a one-off audit or want me as your long-term DPO, I'll make data protection practical, proportionate, and genuinely useful to your business.

Practical professional with experience of driving privacy and related compliance implementation within B2C organisations. CIPP/E and AI Governance Professional qualifications. I deliver - persuasive communications to engage leadership teams in the process - expert and pragmatic GDPR and AI compliance audits - hands-on AI/privacy governance implementations within business critical products - DPO-as-a-service - data breach management - remote and in-person training for AI and GDPR - regular programme updates to keep everyone informed on progress and success. I take a pragmatic, practical and hands-on approach to drive compliance projects forward with a mission to remove obstacles to business value and do so quickly and with high compliance quality.

I'm a data protection and AI governance consultant who also builds software. I help startups, SaaS companies, and online platforms meet their privacy, AI, and EU digital obligations. Because I understand how products handle data, the policies and assessments I produce fit your real systems instead of a template. Most of my work is with companies shipping AI features, scaling a platform, moving into new markets, or getting ready for a customer security review or a funding round. I can help with: • GDPR, UK GDPR, and Swiss FADP compliance programs • EU AI Act readiness and AI governance frameworks • Digital Services Act (DSA) and Digital Markets Act (DMA) compliance for platforms and marketplaces • Wider EU digital regulation: Data Act, ePrivacy, and NIS2 • DPIAs, PIAs, and AI risk assessments • ROPA development, data mapping, and privacy operations • Vendor and third-party risk assessments • Privacy policies, cookie notices, and Data Processing Agreements • SaaS Terms of Service, subscription, and IP terms • Contract drafting and review for tech, AI, and commercial deals • DPO-as-a-service and ongoing privacy advisory • Regulatory research for emerging-tech questions Credentials: ✔ CIPP/E certified ✔ LLM, University of Edinburgh ✔ LLB, University of Essex ✔ Privacy and data protection experience in private practice Clients keep me around because I pair the legal side with a working understanding of how their product is built. My advice stays proportionate to your risk and is meant to hold up as you grow.