RISK Case Study

DATA PROTECTION AND GDPR COMPLIANCE FOR AN EU EXPANSION

An anonymised account of preparing a software business for European data protection expectations before it began processing personal data at scale in the region.

Stravision RISK DivisionAnonymised engagementData protection advisory
6Compliance Workstreams
6Compliance Workstreams
4Delivery Phases
Client Context

Expansion that changed the data obligations

Entering a new region meant new obligations around lawful basis, transparency, data transfers, processor arrangements and individual rights.

The client, its customers and its jurisdictions are confidential, so this account describes the readiness approach rather than any specific processing activity.

Confidentiality note: This case study is intentionally anonymised. It does not identify the client, sector, jurisdiction or any authority involved, and it does not quote or represent any authority.
The Challenge

Know the data before writing the policy

You cannot protect data you have not mapped.

01 / Mapping
Record what is processed
Document the personal data held, why, where it sits and who it is shared with.
02 / Basis
Establish lawful basis
Identify the basis for each processing activity rather than one blanket justification.
03 / Contracts
Fix the agreements
Put processor terms and transfer arrangements in place with vendors and customers.
Engagement Model

Six workstreams to readiness

A framework view of the engagement, not the client's file.

01 / Inventory
Data mapping
Build a record of processing activities, systems and data locations.
02 / Basis
Lawful basis and notices
Determine the basis for each activity and align the privacy notices to it.
03 / Agreements
Processor arrangements
Execute processing terms and confirm transfer mechanisms with each vendor.
04 / Assessment
Impact assessment
Complete an impact assessment where the processing warrants one.
05 / Rights
Individual requests
Define how access, deletion and objection requests are received and answered.
06 / Security
Controls and breach response
Confirm technical controls and a tested breach notification process.
Delivery Sequence

How readiness was sequenced

01
Map
Record what personal data is processed, where and by whom.
02
Establish
Fix lawful basis, notices and processor arrangements.
03
Assess
Complete the impact assessment and close the identified gaps.
04
Operate
Run rights requests, security controls and breach response as a routine.
What Made It Work

What made the position defensible

A real processing record
The inventory reflected the systems in use rather than an idealised architecture.
Executed agreements
Processor terms and transfer mechanisms existed with each vendor that touched personal data.
A working rights process
Access and deletion requests had an owner, a route and a response deadline.
Reported Outcome

DPA signed, DPIA completed

6
Compliance workstreams completed before scaling This reflects the result already published in Stravision's case-study listing. No additional financial, operational or authority-specific outcome is claimed on this page.
Outcome
DPA and DPIA completed
Reported as recorded in the firm's own case-study summary, with client and counterparty details withheld.
Scope
Advisory and coordination
Authority determinations, legal interpretations, regulated filings and statutory audit remained outside the engagement.
Verification
Pending internal signoff
The reported figure should be confirmed by Stravision's authorised factual owner before promotional use.
Important information This anonymised case study is provided for general informational purposes only. It does not constitute legal, regulatory, tax, audit, accounting or other professional advice, it does not quote or represent any authority, and it should not be read as a guarantee that comparable work will produce the same result. Outcomes depend on the facts, scope, client implementation, third party decisions and other circumstances. Obtain advice from appropriately qualified professionals and confirm current requirements before acting.
Related

More case studies from the RISK division

RISK

AML Framework Overhaul After Regulatory Inspection Finding

Cleared re-inspection in 45 days
RISK

Corporate Governance Uplift for a Family Office IPO Readiness

Board structure approved by advisors
RISK

Fraud Risk Assessment Uncovering AED 800K in Procurement Leakage

Controls implemented, zero recurrence
FAQ

With a record of what personal data is processed, why, where it is stored and who it is shared with. Policies come after the mapping.

No. Each processing activity needs its own basis, and the privacy notices should reflect those decisions.

When the processing is likely to present higher risk to individuals. The threshold should be assessed case by case.

Executed processor terms with vendors, a working process for individual rights requests, and a breach response that has actually been tested.

RISK can support data mapping, lawful basis analysis, processor arrangements, impact assessments, rights processes and breach response design within an agreed advisory scope.

No. Legal interpretation and any regulatory position remain with appropriately qualified legal advisers.

It normally begins with a short scoping conversation to confirm the facts available, the evidence that already exists, the decisions required and which elements need an appropriately qualified specialist before any work is agreed.

No. It is the reported outcome for this anonymised case. Results depend on the facts, scope, implementation and decisions taken by third parties.

Authority determinations, legal interpretations, regulated reporting, statutory audit and other reserved work remain with the relevant authority or an appropriately qualified provider.