Contested cases need someone with no stake in the outcome. I investigate misconduct, harassment and grievance allegations for education providers, and I build the complaints frameworks that regulators now require organisations to operate.
Fifteen years in higher education. Eight years of complaints, appeals and conduct casework to Office of the Independent Adjudicator standards.
Commissioned by education providers where internal handling would create a conflict of interest, where capacity is short, or where the allegation is serious enough that independence has to be visible.
Scoping allegations against your regulations, interviewing the parties and witnesses, testing the evidence, and producing a report a decision-maker can act on. I establish facts on the balance of probabilities. I do not decide the outcome, recommend sanction, or sit on the panel.
Code of student conduct · academic misconduct · disciplinary regulations
Trauma-informed interviewing that minimises avoidable distress without lowering the standard of proof or the fairness owed to the responding party. Safeguarding interfaces, precautionary measures and criminal-process liaison handled explicitly rather than assumed.
OfS harassment and sexual misconduct condition · Equality Act 2010
Where the allegation sits inside the reporting line, or involves someone senior enough that internal investigation would be challenged. Same methodology, same separation between finding facts and taking decisions.
Grievance · bullying · whistleblowing referrals
Independent review of a complaint your own process has not resolved, or an audit of how your complaints and appeals procedure would stand up on external review. Findings come with the procedural and systemic issues observed along the way, not just the outcome.
OIA Good Practice Framework · QAA and the UK Quality Code
Since June 2026 every controller in the UK has had to run a complaints process that meets a statutory standard. Most organisations have privacy expertise. Far fewer have ever run a complaints function.
A structured gap assessment against the section 164A duty across five areas: accessibility of the route, whether staff recognise a complaint that does not use data protection language, handling and timeliness, signposting across notices and rights responses, and third-party and assurance arrangements. You get a scored position and a prioritised action list.
Typically one to two weeks
A complaints procedure written to the statutory requirements and to how your organisation actually works: triage that separates complaints from rights requests and breach reports, proportionate investigation, scheduled progress updates, reasoned outcomes, and a register that evidences compliance if the Commissioner asks.
Any UK controller · no sector restriction
Half-day and full-day sessions for the people who will handle the cases. Recognising a data protection complaint arriving through a non-standard route, setting proportionate investigation depth, writing an outcome the complainant can follow, and avoiding the delay that turns a defensible case into a regulatory one.
Front-line teams · DPO functions · complaints teams
Handling complaints directly where volume has outrun capacity, or where a case needs someone outside the team that did the processing complained about.
Interim · project · retained
Every instruction follows a published framework, which is shared with the commissioning provider and available to the parties on request. Nothing is investigated outside the agreed terms of reference.
Compliance & Data Guard Services is the practice of Ransford Stanley, an independent investigator and regulated complaints specialist based in London.
Fifteen years in higher education, including eight leading complaints, appeals and conduct casework to Office of the Independent Adjudicator standards at the University of Plymouth, Canterbury Christ Church University, University College London and the University of East London. The work has consistently been the contested end: allegations involving special category data and safeguarding, appeals under external scrutiny, and the design of the policies and training that follow.
The second strand is data protection. Subject access request handling, information sharing governance, and the UK GDPR applied to decisions that are genuinely disputed rather than routine. That combination — someone who has run a regulated complaints function and understands data protection law — is what the section 164A duty now asks organisations to find.
For investigations, tell me the nature of the allegation, the procedure it falls under and your timescale. For complaints work, tell me where you think the gap is. Initial conversations are free and confidential, and I will say if the work is not something I should take.
rstanley@compliancedataguardservices.com
07586 553272
linkedin.com/in/ransford8stan
Please do not send case papers or personal data about a third party in a first email. I will set up a secure route before anything of that kind is exchanged.