Ecanvasser builds a mature privacy framework that keeps pace with its growth through DPO as a Service

Ecanvasser is field sales software for door-to-door sales teams. More than 15,000 teams in fiber, roofing, solar, pest control and home services, use it to plan territories, track field activity and grow and scale their operations.

Ecanvasser processes personal data on behalf of its customers on a large scale, including large volumes of special category data. Given the nature of this processing, its data protection impact assessment (DPIA) confirmed that it needed to appoint a data protection officer (DPO).

With so much sensitive data in its care, Ecanvasser sees reputational damage as its biggest risk. Compliance has therefore always been a high priority, and privacy is built into everything from product design to software development.

Janet Breen originally fulfilled the DPO role internally. When she was appointed Chief Operations Officer, holding both roles would have created a conflict of interest, so the board chose to appoint an external DPO instead.

At the same time, customer expectations were rising. Brexit had created uncertainty over how data protection would work in the UK, and US customers increasingly regard the GDPR as the gold standard they expect their suppliers to meet.

Ecanvasser first worked with GRC Solutions through training. Janet and her team attended several GRC Solutions courses, including the DPO training course, and the experience gave them confidence that the team had the expertise they needed.

Through GRC Solutions’ DPO as a Service offering, Ecanvasser has worked with a dedicated DPO consultant since 2020. Janet meets the consultant monthly, with additional meetings and emails whenever an issue arises. This gives the engagement a clear structure while leaving room to deal with new matters as they come up.

Support has included:

• Maintaining a privacy action plan, reviewing outstanding gaps and agreeing priorities and target dates with the internal team
• Supporting data mapping, records of processing activities and transfer registers, including reviews of processing purposes and lawful basis
• Reviewing privacy risk registers and DPIAs, including cloud processing details
• Reviewing privacy and cookie documentation, data sharing arrangements and supplier privacy requirements
• Reviewing technical and organisational measures and the privacy aspects of security questionnaires and information security documentation
• Monitoring regulatory developments and advising on their impact
• Providing individual rights guidance, a DSAR log and templates, and coordinating access to GDPR training

Over the course of the engagement, Ecanvasser has developed one of the most robust privacy frameworks among GRC Solutions’ DPO clients.

That foundation paid off when Ecanvasser pursued ISO 27001 certification, the information security standard that larger customers increasingly expect.

A well-maintained privacy programme has also helped Ecanvasser shorten customer due diligence. With ongoing DPO support, its documentation stays current and the team avoids the complacency that can lead to mistakes.

With privacy by design and privacy by default now well established, Ecanvasser’s next priority is managing how staff use artificial intelligence (AI) tools day to day, making sure new ways of working do not introduce new privacy risks.