What is a virtual compliance partner?
A virtual compliance partner is software that keeps your compliance record, controls and evidence, with named human experts brought in when a role needs a person. Naq is a UK compliance platform for companies selling into regulated buyers, and it describes itself as "your virtual compliance partner".
In short: the software side holds the controls, evidence, policies and approvals, and keeps an audit trail of who did what. Some roles have to be filled by qualified people, such as a Clinical Safety Officer (CSO) under DCB 0129 or, where Article 37 requires one, a Data Protection Officer (DPO) under UK GDPR. Those come from your own team or from a named expert working inside the same record. Every decision still goes to a named person to approve.
Where does the term "virtual compliance partner" come from?
The term has no fixed industry definition. Close variants appear mostly among US providers, where "virtual compliance officer" usually means an outsourced person who acts remotely as an organisation's compliance officer. In the UK, the nearest services are sold as a virtual or fractional CISO for security leadership, and a virtual or outsourced DPO for data protection.
Naq uses the term for a different arrangement. Software carries the compliance work from day to day, and a person is brought in by name where a standard or a law requires one.
What does a virtual compliance partner do?
It has a software side and a people side.
The software side keeps one record of your compliance:
- Each control is mapped once and counted in every framework it meets, so work done for ISO 27001 also counts towards Cyber Essentials or the NHS DSPT where their requirements overlap.
- Evidence is attached to the controls it supports, and a control drops back to needs review when its evidence expires.
- Policies start from templates, go through approval, reach the people who must acknowledge them and reopen on their review date.
- Approvals, reviews and expiries collect in one to-do list for whoever owns them.
- Every record carries its own history, so the work stays on file when someone is on holiday or leaves.
The people side covers the roles that a standard or a law requires a qualified person to fill. The software routes reviews and sign-offs to that person and records them. It does not hold the role itself.
How does a virtual compliance partner compare with the alternatives?
The table compares five routes for a company without a compliance specialist.
| Route | What you get | Where the compliance record lives | Roles that need a person | When the person leaves or the work ends |
|---|---|---|---|---|
| Hiring a compliance manager | An employee who runs the programme day to day | In the tools and documents they set up | Covered if they meet what the role requires | What they wrote down stays; what they knew leaves with them |
| A consultant engagement | A firm working to an agreed scope, such as a certification project | In documents prepared during the engagement | Covered if the scope includes them | The work stops at the end of the scope; the documents stay with you |
| A fractional or virtual CISO or DPO | A specialist for part of the week or month, under a service contract | Wherever your organisation keeps it | The one role they are contracted for | A replacement is contracted for the role |
| Self-serve compliance automation software | A platform your own team runs | In the platform | Your own specialist, found by your team | When someone leaves, the record stays in the platform |
| A virtual compliance partner | Software for the record, plus named experts for the roles that need a person | In the platform | Your own specialist, or a named expert working inside the record | When someone leaves, every record and decision stays on file |
The routes can be combined. A company can hire a compliance manager and run the programme on a platform, or keep its existing outsourced DPO and invite them into the same record.
Which compliance roles need a person?
Software can hold evidence and route approvals. Three roles that UK companies selling into regulated buyers often meet have to sit with a qualified person or body.
The Clinical Safety Officer under DCB 0129
DCB 0129 is the NHS information standard for clinical risk management in the manufacture of health IT systems, published under section 250 of the Health and Social Care Act 2012. Its companion standard, DCB 0160, covers the organisations that deploy and use those systems.
Under the DCB 0129 specification (version 4.2, Amd 24/2018), the manufacturer's top management must nominate a Clinical Safety Officer (clause 2.2.1). The Clinical Safety Officer must be a suitably qualified and experienced clinician (2.3.1) and must hold a current registration with an appropriate professional body (2.3.2). That person approves the Clinical Risk Management Plan, each version of the hazard log and each Clinical Safety Case Report (3.2.2, 3.3.2 and 3.5.2).
A platform can hold the hazard log and safety case and send each change for sign-off. The sign-off has to come from a registered clinician.
The Data Protection Officer under UK GDPR
Article 37(1) of UK GDPR requires a Data Protection Officer in three cases: processing by a public authority or body, core activities that require regular and systematic monitoring of people on a large scale, and core activities that consist of large-scale processing of special category data, such as data concerning health, or of criminal offence data.
Article 37(6) allows the DPO to be a staff member or to work under a service contract, and the ICO's guidance confirms a DPO "can be an existing employee or externally appointed". Article 39 sets out the DPO's tasks, which include informing and advising the organisation and the employees who carry out processing, monitoring compliance, giving advice on data protection impact assessments (DPIAs) when asked, and acting as a contact point for the regulator. Article 38(3) says the DPO takes no instructions on how those tasks are carried out and reports to the highest level of management.
A DPO advises; the organisation decides. The ICO's guidance puts it plainly: the DPO "isn't personally liable for data protection compliance", and compliance remains the responsibility of the controller or processor.
Cyber Essentials assessment and certification
Cyber Essentials is the scheme of the National Cyber Security Centre (NCSC), and IASME is the NCSC's Cyber Essentials Delivery Partner. A qualified Assessor from a Certification Body reviews the self-assessment answers, and the certificate is issued once the assessment meets all requirements. Every Certification Body is licensed and assured by IASME, and Cyber Essentials Plus is arranged directly with a Certification Body that IASME has licensed for the Plus audit.
Software can hold the controls and evidence behind your answers. The assessment and the certificate come from an IASME-licensed Certification Body. Naq is licensed by IASME as one, and using its platform does not award a certificate.
How does Naq work as a virtual compliance partner?
Naq is governance, risk and compliance (GRC) software, hosted in the UK. It maps each control once and counts it in every framework it meets, from ISO 27001 and Cyber Essentials to the NHS DSPT, DTAC and UK GDPR. Policies start from templates already mapped to your frameworks, and the approved version goes to everyone who must acknowledge it. When evidence expires, the control it supports drops back to needs review. Naq keeps activity timelines and an audit log, so decisions stay on file through holidays and leavers.
Naq AI reads and suggests, and a person decides. Naq Assistant is read-only: it can read your records but cannot create, edit, approve or delete them. Naq AI never runs on its own. Every scan, summary or draft starts from a button a person pressed. Each suggestion is reviewed, confirmed by a named team member and timestamped.
For the roles that need a person, Naq's answer is your own DPO and CSO, or a named expert from Naq's partner network. A company that already has a specialist, in-house or outsourced, invites them as a user and assigns them the named role. A company that needs one can take on a specialist firm from Naq's partner network and meet them before committing. In both cases the specialist works inside the Naq workspace, and their review or sign-off is recorded against the record. On the hazard log and safety case for DCB 0129, the Clinical Safety Officer, a registered clinician, is the default approver.
When does a virtual compliance partner fit?
It fits a company that needs compliance work running before it can justify a full-time compliance hire, where compliance sits with a founder, a CTO or an operations lead who has another job to do. It also fits a team where one person carries several frameworks and reviews stall whenever that person is away.
It fits less well if you want the whole programme taken off your hands. Your team still approves the decisions that a standard does not reserve for a role such as the Clinical Safety Officer, and those roles still need a qualified person.
Frequently asked questions
Is a virtual compliance partner the same as a virtual compliance officer?
No. A virtual compliance officer is usually an outsourced person who acts as your compliance officer. A virtual compliance partner, as Naq uses the term, is software that keeps the compliance record, with named experts brought in for the roles that need a person.
Can software be my Data Protection Officer?
No. Under UK GDPR Article 37(6), a DPO may be a staff member or fulfil the tasks under a service contract, and Article 37(5) requires expert knowledge of data protection law and practices. Software can hold the records a DPO reviews, such as the processing record and DPIAs, and record their advice.
Who can be a Clinical Safety Officer under DCB 0129?
A suitably qualified and experienced clinician who holds a current registration with an appropriate professional body, under clauses 2.3.1 and 2.3.2 of the DCB 0129 specification. In Naq, that is your own Clinical Safety Officer or a named expert from Naq's partner network, and their sign-off is recorded in your Naq record.
Does a virtual compliance partner issue Cyber Essentials certificates?
The certificate comes from an IASME-licensed Certification Body, after a qualified Assessor has reviewed your answers. A virtual compliance partner holds the controls and evidence that sit behind those answers. Naq is licensed by IASME as a Certification Body, and using its platform does not award a certificate.
Do I still need someone on my team?
Yes. A virtual compliance partner routes each decision to the right person to approve, on your team or, for a sign-off such as the Clinical Safety Officer's, in that named role, and keeps a record of who approved what. It replaces the spreadsheets and chasing, and leaves the decisions with people.
How is it different from self-serve compliance automation software?
Both keep the compliance record in a platform. A virtual compliance partner also provides a route to named experts for the roles that need a person, such as a Clinical Safety Officer or a DPO, who work inside the same record.
To see how the record and the named roles would work for the frameworks you hold, book a demo.
