Recognising the growing importance of data protection and the emergence of AI within the workplace, Ithaca Partners engaged Evalian to provide ongoing outsourced DPO support and practical AI governance guidance. Through a tailored approach that reflected the realities of a small, specialist consultancy, Evalian helped the firm strengthen compliance, navigate evolving regulatory requirements and adopt AI responsibly, giving the team confidence that their governance practices remain effective, proportionate and fit for purpose.

What role do governance, trust and reputation play within Ithaca Partners?

We are a very small corporate affairs executive search firm. We’re a team of seven, and we focus on top-end searches for major organisations, recruiting corporate affairs directors, public affairs directors, communications directors and similar senior roles.

Most of our placements are Exec level or one level below, so we’re working with senior people in large organisations. Our clients include companies such as BA, Sky and NatWest, and many are repeat clients. A lot of our business comes through word of mouth and recommendations.

We’re very much a headhunting business rather than simply advertising roles. We map the market, and proactively approach people we believe are suitable. We also do some coaching and leadership development work alongside executive search.

Trust and reputation are incredibly important to us. Our business is built on relationships, discretion and personal recommendations. We deal with personal information every day and work with senior individuals, so governance and compliance are areas we take seriously.

What led you to engage Evalian for DPO support, and what challenges or objectives were you looking to address at the time?

A few years ago, we realised that GDPR was too important an area for us not to have properly sorted and future-proofed. We deal with personal information and store that information in our database. We’re not dealing with hundreds and hundreds of CVs A day. We generally work on eight to ten searches a year. So we haven’t got the volume of a mass recruiter, but as I said, we are dealing with personal information.

We’re not GDPR experts and don’t claim to be. We recognised that it was an area where we needed specialist support. We initially got in touch because we thought, “We probably need some policies,” but it quickly became clear that having expert guidance was about much more than that.

The internet is great, and you can Google lots of things, but GDPR is a significant area. We wanted confidence that we were doing things correctly. It’s a bit like executive search. If it were as simple as using LinkedIn to find the right people, firms like ours wouldn’t exist. Sometimes you need expert support.

View Outsourced DPO services

How has outsourced DPO support helped your business over the last two years, and what impact has it had on your team?

The biggest benefit has been reassurance. Neil regularly checks in and keeps us updated on changes we need to be aware of. In fact, last week he sent me a policy I didn’t even know I needed because of a regulatory update.

I’m not looking for ICO updates every five minutes, and I don’t have time to be. Knowing there’s someone in the background monitoring these things and telling us what action we need to take is hugely reassuring.

It means Laura, Alex and I feel we’re in a good place, that we’re on top of things and that the business is protected. If something did happen, I’d immediately go to Neil and ask, “What do we do now?” and I’d have confidence he’d guide us through it.

Are there any examples where Evalian’s expertise has helped you navigate a particular compliance challenge, project or business decision?

One example involved our website and cookie requirements. A question was raised about whether we needed a cookie policy and a cookie banner. I went straight to Neil because I wasn’t sure whether we had a problem. He worked through it with us and explained that, because we weren’t actively using Google Analytics, we didn’t need the cookie policy or banner we thought we might.

It became a useful three-way conversation that helped us remove unnecessary elements from the website while remaining compliant.

Another example involved supplier onboarding questionnaires. Larger organisations often have very detailed GDPR and security requirements. There was one in particular where I was sending Neil screenshots, asking, “Is this a yes or a no?” He effectively filled in the blanks for me, explaining which answers applied to us and which didn’t. That gave us confidence that we were answering accurately rather than guessing.

He also helped us understand our position on retaining CVs. Initially, we were concerned about how long we kept candidate information. Neil explained that because of the nature of executive search and the long-term relationships we maintain with candidates, we have a legitimate reason for retaining that information for longer periods. That guidance was extremely helpful.

Neil spent a lot of time with all of us when we first started working together to understand exactly how we operate. He took the time to understand that executive search is a niche market and that we’re not a high-volume recruiter processing hundreds of CVs every day. Because he understood the way we work, the advice was practical and relevant to our business. Whether it was data retention, candidate information or supplier onboarding requirements, the guidance reflected the reality of how Ithaca operates rather than applying generic rules.

How would you describe the working relationship with Evalian’s consultants?

Brilliant. Neil is a joy to deal with. He’s highly knowledgeable and clearly knows his stuff, but what is lovely is that he explains everything in a straightforward way. There isn’t a lot of legal jargon. Everything is explained in a way that’s practical and applicable to our business.

It would be very easy for Evalian to take a one-size-fits-all approach, but Neil has adapted his advice to suit us as a small business. He checks in regularly, understands how we operate and provides guidance that’s appropriate for our size and the way we work. He’s genuinely a pleasure to work with.

More recently, Ithaca has engaged Evalian for AI governance support. What prompted those conversations?

We’re not heavy users, but several members of the team use AI in different ways, and we wanted to make sure we were using it responsibly and appropriately. As with GDPR, we felt it was an area where we needed expert guidance rather than trying to figure everything out ourselves.

View Evalian’s AI Governance service

As AI becomes more widely used across businesses, what were your biggest concerns or considerations as an organisation?

I wouldn’t say we had major concerns. It was more about understanding how to use AI appropriately and making sure we were doing the right things. We wanted reassurance that our approach was sensible and that we understood both the opportunities and limitations.

One of the key messages was recognising that AI is only as good as the information you put into it, and that it isn’t always accurate or up to date.

How has Evalian helped you approach AI adoption in a way that balances opportunity, governance and risk?

When our Evalian Account manager first spoke to us, he suggested lots of policies, but there are only 7 of us; we didn’t need hundreds of AI policies.

What we appreciated was that our account manager agreed and realised that we didn’t need a huge amount, and so Evalian were very accommodating in being able to adapt to our needs and helped us to keep it simple. We’ve got three or four AI policies in place now, and we mention it in our Privacy notice.

We then had a call with Ray and our team, and he helped us understand which platforms were appropriate and provided practical guidance that suited our business.

Have there been any insights or outcomes from the AI governance work that have been particularly valuable?

The work largely confirmed what we already suspected about AI. It reinforced that AI can be a useful tool, but it needs human oversight and judgment.

We’ve seen examples where AI-generated information wasn’t fully accurate or up to date, which means you still need people applying critical thinking and checking information independently. That reassurance and validation have been valuable.

Download your free Guide to AI Act Compliance

Looking across both the DPO and AI governance support, what have been the biggest benefits for the business?

The DPO support has probably had the biggest impact because data protection is such a fundamental part of what we do. The biggest benefit is confidence. We feel sorted, we feel up to date, and we feel future-proofed.

Knowing that our policies are reviewed regularly and updated when required gives us confidence that we’re doing the right things without having to monitor every regulatory change ourselves.

Has working with Evalian changed the way your organisation thinks about data protection, governance or emerging technologies?

Yes. One example is how we communicate sensitive information. When we’re running a search, we send weekly updates internally, containing sensitive information. Following advice from Evalian, our communications are clearly marked as confidential across the business.

It’s also made data protection more front of mind generally. We regularly remind the team about handling information appropriately, being careful with sensitive data and making sure confidentiality is maintained.

What has made the relationship successful enough to continue over the past two years?

Data protection is too important for us to take chances with. It’s reassuring to know we have an external expert providing up-to-date advice and keeping us informed about changes that matter.

Could I update policies myself? Probably. But I’d then be spending time researching legislation, checking guidance and trying to work out whether I’d missed something. Neil already knows what’s changed because he’s working in this space every day. That expertise, reassurance and ongoing support are what make the relationship valuable.

Evalian has never taken a one-size-fits-all approach. Neil invested time upfront understanding our business, how we work with candidates and clients, and the realities of executive search. Because of that, the advice always feels relevant and proportionate to our business rather than generic compliance guidance. The training available through the portal is also a useful added extra.

What would you say to another organisation considering outsourced DPO or AI governance support?

I’d definitely recommend speaking to Evalian. We spoke to a couple of other providers before making our decision and found Evalian to be the best fit. We were quoted ridiculously high costs for what was, effectively, a generic solution, whereas Evalian’s approach is more bespoke. 

The knowledge is superb, but what really stood out was that the DPO advice was tailored to us rather than being a generic solution.

For a small business like ours, that flexibility and understanding made a huge difference.

If you’d like to understand how Evalian can support your team with tailored Data Protection or AI Governance, get in touch using the form below.