Compliance packages and prices
Fixed-price service fees, from $250. Government POTRAZ fees are separate and billed at cost. Existing Lioncap Ventures clients save 10% on the service fee.
Starter · Get Licensed: $250
For: Small organisations, single sites
Everything you need to get licensed and pass a first inspection.
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- POTRAZ processing notification
- Records of Processing (ROPA)
- Privacy policy and consent wording
- Data Protection Impact Assessment where health or minors’ data applies (standard form)
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Physical records security checklist
- Staff data protection training, one session up to 5 people (CDPG 1 of 2025)
- DPO appointment guidance
Pro · Inspection-Ready: $650
For: Mid-size organisations, multiple departments
Full documentation and assessments so an inspector finds nothing missing.
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- POTRAZ processing notification
- Records of Processing (ROPA)
- Privacy policy and consent wording
- Data Protection Impact Assessment where health or minors’ data applies (standard form)
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Physical records security checklist
- Staff data protection training, one session up to 5 people (CDPG 1 of 2025)
- DPO appointment guidance
- Full DPIA with legitimate interest and transfer assessments
- Expanded ROPA across departments and systems
- Third-party DPAs and data sharing agreements
- Prioritised remediation plan (secure communications, device encryption)
- Staff training extended to 10 people across multiple sessions
- Cross-border transfer assessment
Enterprise: from $1,500
For: Large enterprises, groups, government MDAs, high data volumes
Audit, multi-site rollout and ongoing reviews for complex organisations.
- CDPA gap analysis & report
- POTRAZ Data Controller licence application (Form DP1) prepared & filed
- POTRAZ processing notification
- Records of Processing (ROPA)
- Privacy policy and consent wording
- Data Protection Impact Assessment where health or minors’ data applies (standard form)
- Data breach response procedure
- Data subject access request (DSAR) procedure
- Physical records security checklist
- Staff data protection training, one session up to 5 people (CDPG 1 of 2025)
- DPO appointment guidance
- Full DPIA with legitimate interest and transfer assessments
- Expanded ROPA across departments and systems
- Third-party DPAs and data sharing agreements
- Prioritised remediation plan (secure communications, device encryption)
- Staff training extended to 10 people across multiple sessions
- Cross-border transfer assessment
- Full CDPA compliance audit
- Multi-site rollout
- Board + all-staff training
- Cross-border data transfer notifications
- Quarterly compliance reviews
Data Protection Officer (DPO) retainer tiers
Under SI 155 a licensed data controller must appoint a Data Protection Officer. Lioncap Ventures provides your required DPO on record. Retainers are billed monthly, quarterly (monthly rate times 3), or bi-annually (monthly rate times 5, the discounted cadence).
Outsourced DPO, priced by organisation size
- Up to 1,000 records: $50/month (quarterly $150, bi-annual $250)
- 1,001 – 100,000 records: $150/month (quarterly $450, bi-annual $750)
- 100,000 – 500,000 records: $250/month (quarterly $750, bi-annual $1,250)
- Over 500,000 records: $400/month (quarterly $1,200, bi-annual $2,000)
Dedicated DPO, priced by industry group and size
-
Group A · Healthcare, Insurance, Financial, Schools & Tertiary
- Up to 1,000 records: $300/month
- 1,001 – 100,000 records: $450/month
- 100,000 – 500,000 records: $550/month
- Over 500,000 records: $1,100/month
-
Group B · Mining, NGOs & PVOs, Other private company
- Up to 1,000 records: $260/month
- 1,001 – 100,000 records: $380/month
- 100,000 – 500,000 records: $450/month
- Over 500,000 records: $780/month
-
Group C · Government & Local authorities, Religious
- Up to 1,000 records: $220/month
- 1,001 – 100,000 records: $320/month
- 100,000 – 500,000 records: $450/month
- Over 500,000 records: $560/month
A full-time embedded DPO is available by quote. If you already have your own DPO, no Lioncap retainer applies.
Frequently asked questions
Do I need a licence?
Yes. Under SI 155 of 2024 every organisation that holds personal data must register as a licensed Data Controller with POTRAZ. From 1 September 2026 inspectors can check this, and operating unlicensed is an offence. We prepare and file the application for you.
Is a DPO required, and can Lioncap be ours?
Yes. Under SI 155 a licensed data controller must appoint a Data Protection Officer, the person accountable for your compliance with the Cyber and Data Protection Act. Lioncap Ventures provides your required DPO on record. Choose an outsourced DPO priced by size, a dedicated DPO priced by your industry group and size, or a full-time embedded DPO by quote. Retainers are billed monthly, quarterly at three months, or bi-annually at five months for six, which is the cadence where the discount applies.
What are the POTRAZ fees?
The government fees are separate from our service fee and are billed at cost with no markup. There is a $30 application fee from Tier 2 upward (no application fee applies at Tier 1), plus a Data Controller licence fee that scales with how many records you hold, from $50 for the smallest organisations up to $2,500 for the largest. These POTRAZ figures are exclusive of VAT, which POTRAZ adds on its own invoice. That is why we quote our fee and the POTRAZ fees as two separate numbers and never give you a single all-in total: we will not quote you a figure that depends on a tax rate we do not set. You pay POTRAZ exactly what POTRAZ bills us. The licence renews annually at the tier fee, and we handle the renewal filing under your DPO retainer.
How long does it take?
Most small organisations are documented and filed within one to two weeks. Larger enterprises, groups and government MDAs take a little longer because of the audit and multi-site work, but we build a timeline to have you inspection-ready before the deadline.
What about paper records?
Paper records are in scope. Inspectors look at filing rooms, registers and archives. Every package includes a physical records security checklist so your paper files meet the same standard as your digital ones.
What does the DPO retainer actually cover?
Every tier covers the same duties: your named certified DPO on record with POTRAZ, breach and incident on-call including the notifications if an incident is reportable, data subject requests handled end to end, your records kept current and processing changes notified to POTRAZ, a compliance report to management, the annual audit, policy review and training refresher, the annual licence renewal filing, and a POTRAZ inspection attended. What changes between tiers is the service limits, not the duties: a Tier 1 organisation at $50 a month gets up to 2 data requests a quarter, next-working-day breach response and a six-monthly review, while larger tiers get faster response times, more frequent reviews and higher volumes. A smaller organisation pays less because it is smaller, not because it is less covered. Work outside the retainer, such as an impact assessment for a brand new system or a material-change assessment, is quoted separately.
What happens in the compliance consultation?
The consultation is a one-hour working session at $90. Our data protection officers confirm your controller and processor status, map your data footprint, the records you hold, your sites and systems, and the partners you share data with, and confirm your exact POTRAZ licence tier. From that we complete your assessment and issue an accurate quotation, and the $90 is credited in full toward your compliance package when you proceed.
How is my licence tier determined?
By the number of individuals whose personal data you hold in total, counting staff, customers and partners: Tier 1 up to 1,000 records, Tier 2 from 1,001 to 100,000, Tier 3 from 100,001 to 500,000, and Tier 4 above 500,000. The consultation confirms your tier before anything is filed, so you never pay for a bigger licence than you need.
When do we sign a contract?
Straight after the consultation, together with your assessment and quotation. The agreement covers both sides: our obligations, your named certified DPO on record, deliverables and timelines, confidentiality, breach and incident response, and the POTRAZ filings, and yours, access to the information we need, a point of contact, and the agreed fees. Nothing beyond the $90 consultation is owed until you have read it and chosen a package.
What if I miss 1 September?
Once inspections begin, being unlicensed or undocumented exposes you to enforcement action and penalties under the Act. The safest path is to get licensed and inspection-ready now. If you have already missed a step, we can fast-track the essentials first.