1bigthink provides the privacy and AI compliance expertise mid-sized, high-growth organizations need, managed by a senior practitioner. Coverage spans 140+ jurisdictions.
Trusted by teams at
Led by David Ross, CIPP/E, CDPSE, CPIM, FIP (Fellow of Information Privacy), and CDPSE (Certified Data Privacy Solution Engineer) former Baker Tilly privacy practice lead, and Georgetown adjunct professor. Engineering background from Carnegie Mellon and the University of Maryland.
Your company is growing. You're entering new states, maybe the EU, UK, or Canada. Enterprise buyers are sending 50-to-100-question security and privacy reviews before they'll sign. And now your product team is shipping AI features that trigger a second, faster-moving set of obligations on top of the first.
You don't have the volume of work to justify a full-time Data Protection Officer, and even if you did, a search would take 90 to 120 days you don't have. Meanwhile the gap sits open: in your contracts, your enterprise deals, and your board deck.
1bigthink isn't an audit shop. We build the privacy and AI compliance program, then we run it: DPIAs, vendor reviews, staff training, regulatory monitoring, and the DSAR queue, handled on your behalf, month over month.
We're the execution arm outside counsel needs. Counsel identifies the legal risk. We build the program that closes it and keeps it closed.
David Ross brings a combination that's hard to find in this field: deep privacy and AI regulatory expertise (CIPP/E, CDPSE, a Baker Tilly privacy practice) paired with an engineering background (Carnegie Mellon, University of Maryland, General Dynamics), so he understands your data flows and infrastructure, not just the law around them.
See David's full credentials →What we do
Full data protection officer coverage for US, UK, EU, and international operations. Ongoing program management, not a one-time audit.
Plus proactive support as it comes up: Privacy by Design advisory for new products, cookie and website compliance reviews, and regular regulatory briefings.
Learn more →Full compliance coverage across 20+ US state privacy laws and Canada, a lower investment than full DPO coverage.
Learn more →Governance, monitoring, and hands-on execution for AI regulatory obligations, priced and delivered as its own service or an add-on.
Learn more →Security leadership for growing teams that need technical governance alongside privacy, without a full-time security executive.
Learn more →No. We don't provide legal advice or hold attorney-client privilege. We work alongside your outside counsel. They identify legal risk and set policy direction, and we build and run the operational program that puts it into practice: DPIAs, vendor reviews, training, and day-to-day compliance execution.
GDPR requires a DPO to be both functionally independent (Article 38) and an expert in privacy regulation (Article 37). Independence means the DPO can't hold a role that determines how personal data gets processed, which is why regulators treat placing a CEO, CFO, or other senior executive in the role as a near-automatic conflict. That combination, independence plus real expertise, is difficult for one internal hire to satisfy. 1bigthink is structured to meet both requirements, so you're not solving for them internally.
We start by evaluating your highest-risk program elements first, not running a lengthy assessment before touching anything. When we find a gap, we remediate it immediately, then move to the next highest-risk item. That reduces your exposure right away, and gets you to a compliant program faster than the traditional assessment-then-remediation model, where nothing gets fixed until the assessment is done.
Compare 1bigthink to the cost of building this in-house, or schedule a consultation to talk through your specific jurisdictions and timeline.
