Data protection programmes succeed or fail not on legal knowledge but on whether people actually change how they work. The skills that make the difference - business analysis, stakeholder engagement, change management, communicating upwards - are not what law school teaches.
I'm Tim Clements, and I am Purpose and Means. I fill that gap. For companies that want a programme that holds up when the lawyers aren't in the room. And for data protection leaders who've been handed a role and are figuring it out as they go.
What I do for companies
Most of the work I'm commissioned for falls into three areas. Custom education that people actually remember, because it was built around how your company works rather than dropped in from a catalogue. Workshops that bring the right people into a room and reach decisions that matter. And strategy work that connects your regulatory obligations to how the business actually operates - so the programme stays relevant when leadership changes, budgets shift, or a new product launches without warning.
I've delivered this for clients across financial services, healthcare, professional services, and the public sector. The work is practical, not theoretical - grounded in what regulators have actually fined companies for, not in what the frameworks say should happen.
See client cases →Three things a reasonable competitor would dispute
No legal background. That's deliberate.
Every other data protection consultancy you're likely to consider is run by a lawyer or led by one. I'm not. Before Purpose and Means, I spent years working inside some of the world's largest companies - driving change, building programmes, learning what compliance looks like from the inside rather than from a law firm. Since then I've worked across multiple sectors as a consultant, which means I recognise the patterns quickly: what works, what gets written down and ignored, and where the real risk usually lives.
Regulatory knowledge isn't the gap. Knowing how to make it work inside a real company is - and that's what I bring. I've worked alongside legal teams for years; the difference is I bring what they don't, not a replacement for what they do.
Enforcement-led, not framework-led.
I don't build programmes around what the frameworks say should happen. I build them around what regulators have actually fined companies for. There's a meaningful difference - most of the pain in enforcement decisions comes from operational failures, not legal misunderstandings.
Fixed outcomes, not daily rates.
I charge for what changes, not for time spent in your building. That alignment matters: a day-rate consultant has an interest in things taking longer. I don't.
What I do
My focus is sharp and deliberate - tackling the challenges I'm best equipped to solve.
Browse by Topic
If you're a data protection leader, not a buyer
Not everyone who lands here is commissioning work for a company. Some of you have been handed a data protection role - probably alongside other responsibilities - in a company that doesn't fully understand what they need from you. Law school and certifications don't cover the part that actually matters: how to do the job when nobody has defined it properly.
That's what the newsletter and courses are for.
The newsletter
Practical, fortnightly. Covers GDPR, AI governance, and what being effective as a data protection leader actually looks like. 130 people read it. It's free.
Subscribe →FieldTalk
A free, practitioner-led conference. No sponsors, no vendor pitches. 17–19 November 2026.
Register →Courses
Short, practical courses on the things certifications don't teach. Starting with the moment every new data protection leader faces in week one.
Find out more →
