Applied Privacy Consulting

Applied Privacy Consulting provides fractional Data Protection Officer services, AI governance, and privacy program build for US companies operating under GDPR, UK GDPR, and US state privacy laws.

The practice was founded on a specific observation. In most companies the privacy obligation is understood — the work simply cannot keep pace, because it sits with a general counsel, IT lead, or compliance generalist who already has a full-time job. The traditional answer does not fit that gap. Large firms arrive with a standard methodology, spend limited time understanding how the business actually operates, and hand over a policy pack the client then has to operationalise alone, which is precisely the thing they lack the capacity to do. The advice is rarely wrong. It just isn't executable by the people who have to live with it.

Services include fractional DPO appointment on a monthly retainer, AI governance program build covering inventory, use-case risk classification and impact assessments, DSAR process design, data mapping and RoPA, PIAs and DPIAs, regulatory horizon scanning, and role-specific privacy training.

Engagements take three forms: fixed-scope project work delivered in four to twelve weeks, ongoing fractional retainers tiered from roughly two to eight days a month, and hourly or day-rate work for anything without a standing commitment. Pricing is known before work begins.

The practice is led by Rasha Hisham, CIPP/US, with over ten years in compliance and privacy across in-house and advisory roles. That includes global ownership of data privacy and AI governance at a multinational property operator managing over a million units across the US, EU, UK, APAC and LATAM — building DSAR intake at over 1,000 requests annually, delivering more than 100 PIAs and DPIAs, and establishing a RoPA covering over 100 processing activities. Earlier roles span a Big Four firm in US and Middle East financial regulation, and a sovereign investment institution.