2026: Continued DPO Service with additional AI Governance Support

When Caraffi first partnered with Evalian in 2022, the focus was on establishing a strong foundation for data protection as the business continued its rapid growth. Five years later, that relationship has evolved alongside both the organisation and the wider regulatory landscape. Caraffi has doubled in size again, expanded internationally across Europe and the US, and broadened its services to include outsourced talent acquisition solutions.

As data protection requirements have become more complex and AI governance has emerged as a business-critical priority, Evalian’s role has grown beyond outsourced DPO support to provide ongoing guidance across privacy, compliance and responsible AI adoption. Today, Caraffi relies on Evalian’s expertise to help navigate contract negotiations, support international growth, strengthen governance frameworks and build confidence in the safe use of emerging technologies, ensuring compliance keeps pace with innovation.

Long-Term Partnership

Since we first worked together, how has Caraffi changed as a business? Caraffi has grown significantly in this time (now has 107 employees, so doubled in size again since we first engaged Evalian) and extended the service lines we offer to our clients. We are still acting in an advisory capacity, developing solutions across future talent planning, performance development, talent acquisition, research technology and employer branding; however, we now also deliver outsourcing solutions for our clients across both the permanent and contract TA space and have expanded into outsourced solutions and work across a number of different geographical locations. As well as the UK, we also operate in various countries across Europe and the US.

Has data protection become more important as the business has grown? Without a doubt. Long-term outsourcing customers need a partner who demonstrably understands data protection – it gives them confidence that they can trust us. The increased use of AI across the business landscape has also created a new need for enhanced governance. Employee growth also increases the demand for training and ensures our people are clear on their responsibilities across both DP and AI governance.

What has been the biggest benefit of having access to an outsourced DPO over the last 5 years? It’s the on-hand expertise. It’s like having an in-house expert to call on whenever we need a contract reviewed, policy updates, training or just some general advice and guidance. Evalian are always available and very responsive – we never have to wait long for what we need. We always take on board the advice and guidance provided by Evalian to aid our decision-making and build this into our contracts or agreements.

Have there been any situations where Evalian helped you navigate a difficult compliance or privacy issue? Yes, very recently, with a new contract we were negotiating with a client. We were proposing the development of an AI solution as part of the agreement and needed to ensure that we were covered from both a DP and AI angle. Both areas are complex to understand. Evalian stepped up, provided advice and guidance from the start and enabled us to get to contract signature, knowing that we were covered from both a DP and AI governance angle.

What would be the impact if you no longer had access to that support? Without the support of Evalian, it’s likely we would need to find another service provider, as I would not be comfortable running the business without this level of expert support. It’s invaluable to Caraffi.

AI Governance Support

What prompted Caraffi to seek AI governance support? Much like with the DP element, Caraffi are not experts in this area. AI usage is on the increase in the business world, and Caraffi want to permit some AI usage in the business but carefully and compliantly. As such, we needed to create a governance framework that enables the introduction of AI whilst minimising risk. Additionally, we were starting to develop an AI solution and needed to understand the complexities of being compliant when doing so.

How are you currently using AI across the business? Currently, Caraffi does not permit the use of AI formally. We are well underway with the governance process and are doing some work internally to ensure that our systems are ready. Once this work is completed, approved AI platforms will be introduced, policies will be rolled out, our people will be trained, and compliance will be monitored.

What concerns or risks were you looking to address? Recruitment is a high-risk area for AI adoption. We need to ensure people are not using Caraffi or individual personal data to train AI models, and some free versions don’t allow this to be switched off. We are also looking to raise awareness of the risks associated with AI and provide rules and regulations around what our people can and can’t use. We don’t want to restrict AI too much, as its benefits are clear; however, we want to ensure our people are fully aware of the pitfalls of over-reliance and lack of human intervention, etc.

How has Evalian helped you build confidence around AI adoption? Having Evalian conduct the initial audit, develop policies aligned to our business practices, deliver initial training and just generally be on hand for help and guidance has built confidence across the business hugely. We know that we have experts we can call on if there are things we are unclear about or need support with – it’s really important to us, especially in an area that’s changing so quickly all the time.

What advice would you give to other organisations looking to introduce AI responsibly? Unless you have in-house expertise, don’t try to go it alone. The world of AI is a minefield; there is so much to consider, not just with how people use it, but also contractually in regard to intellectual property, etc. A clear governance framework is essential.

Measurable Outcomes

Has data protection or AI governance helped support new business opportunities? Yes, 100%. We call Evalian when negotiating any new contract to ensure we are covered from DP and AI angles.

Have you reduced internal time spent managing compliance issues? Yes, we just raised the query with Evalian who provide the advice and support required depending on the issue. It saves a huge amount of time that I would otherwise have to spend managing them. We are ISO9001/27001 accredited, and having Evalian as a support partner in this space has certainly been a positive each time we have been audited for continued compliance.

Have there been any avoided risks, incidents or issues? Nothing that I can think of, but I would suggest that this is due to the fact that we have the framework in place and have educated our employees, so we avoid incidents happening in the first place.

2022 – Initial DPO Support

Back in 2022, Caraffi was a fast-growing business with ambitious plans and a clear understanding of the importance of data protection. As the organisation expanded and processed increasing amounts of candidate and employee data, the team recognised the need for expert guidance to strengthen GDPR compliance, support marketing activities and establish robust processes for the future. Rather than relying on a self-service solution, Caraffi wanted direct access to experienced specialists who could provide practical, business-focused advice whenever it was needed.

Challenge

What challenges were you and your team experiencing prior to working with us – what prompted you to seek a solution? Some of the service lines that we provide to our clients require the processing of some personal candidate/employee data. We were aware that this level of processing data may require a DPO. We had no specific data protection expertise within the business and were keen to ensure that our business was meeting our GDPR compliance obligations from the outset. Additionally, Caraffi also carries out B2B marketing and needed to ensure we were meeting our direct marketing obligations.

As a fast-growing start-up organisation, the words “data protection” and “GDPR” seem to instil fear; it’s not terribly easy to understand, and as a business, we were keen to be on the right side of it and do everything correctly. We needed a full audit on what we already had in place, advice and guidance on what needed to change and finally ongoing day-to-day support. It was also important for us to have a clearly designed, well-articulated process as to what we would need to action in the event of a data breach.

Prior to engaging Evalian, internally we had written and created an online video to train our employees annually on GDPR, through this medium, we were unable to conduct assessments or record the completion of these assessments. So we had a requirement for a provider of online training that we could use to assess people against the data protection rules and regulations, and how we operate in Caraffi so that we are fulfilling our obligations.

How did you go about searching for the solution and services? We found Evalian through a Google search and spoke to three other organisations, offering similar services, but in different ways, for example, one was a fully remote online solution.

Please describe the reasons you decided to work with us. Was there a tender process or a referral? I liked the personable approach that I felt Evalian had from our initial chat. We decided we didn’t just want an online portal; we wanted to be able to phone somebody up and speak in person. It was that human real-world approach that Evalian appeared to have that helped inform our decision.

Did you have any expectations going into the process? My expectations were that we would have more to do than we actually did! Turns out that the work we had put in internally prior to contacting the experts was not wasted and was a good starter for 10.

Solution

Can you describe the process we took your business through and anything you learned about your own business through working this way? Evalian conducted a Gap Analysis, which confirmed areas we were compliant in, and areas we needed to strengthen and improve upon. From there, a remediation plan was formed. The speed at which our Evalian consultants have come back to us has been really helpful. Our clients and stakeholders expect us to respond really quickly in our industry, so we realised having a partner that understands that is paramount to our business.

Were there any challenges you found along the way, and how did you feel your consultant or we helped to support you through that? Getting our head around the whole topic is difficult, but our designated consultant is great at explaining things in layman’s terms. I don’t feel there have been challenges, since getting Evalian on board, it’s been a real weight off, knowing that advice is on the end of an email or call.

What changes did you make as a result of working with us? We are well on our way to having our policies nailed down. We have also been ensuring the entire workforce is up to speed on GDPR, raising awareness on file encryption and password protection, and we’ve created our assessments and revised a number of existing agreements to ensure compliance. We regularly have Evalian review data protection and GDPR clauses in contracts so we can be sure we have everything covered and that our clients know that we take data protection seriously at Caraffi and have everything covered.

Impact

What has been the most significant achievement for your business facilitated by working with us? Evalian has really helped us get things moving forward. We get contracts and agreements regularly, and it’s been helpful to have that professional support on hand to ensure everything is sewn up and done correctly, which is key.

What impact has the results from working with us had on your clients/stakeholders? Our clients and stakeholders can feel confident knowing that we really know what we’re talking about. For customers, it’s that sense of safety that we look after their data in the correct manner.

What do you hope to achieve in your future working relationship with us? We need to undertake incident response training so we know what to do if we experience a data breach. We want to make sure we are always up to date and up to speed with everything, and we will be able to demonstrate that we’ve taken every action we possibly can to mitigate a potential breach.

Learn more about our DPO services.