Same task, different delivery, different usefulness

Background and challenge

A regulatory inspection raised remediation requirements across policy, technology and process, and the self-inspection points of Doc No. 93 had to be checked one by one. Around 100,000 fields sat across several generations of systems, with large volumes of unstructured policy and image data that could not be sorted by hand. The annual risk assessment report is due before 15 January, so remediation had to close out on the regulator's timeline.

What we delivered

System deployment

DataAigis Data Security & Compliance deployed on-premise; every data source auto-tagged, then checked by experts

Risk assessment report

Interviews and research benchmarked against the regulatory measures and Doc No. 93, producing a gap list and remediation plan

20+ policy documents

Covering all nine stages of the data lifecycle, reviewed by lawyers before formal release

On-site team

Three data security engineers and one project manager on site all year for training, drills and remediation follow-through

Deliverables

Client value

• Classification results feed directly into access control, masking, encryption and risk assessment, so regulatory filings are ready-made
• Someone owns data security all year: the on-site team uses the system to watch assets, permissions and alerts, and closes out incidents
• Acceptance deliverables map one-to-one to the regulator's checklist: what inspectors check is what gets delivered

From regulatory remediation to continuous operations: phase one covered core systems, phase two extended to every information system with a year-round on-site team. The client bought both phases in succession.

Background and challenge

The China subsidiary of a foreign P&C insurer runs its core system alongside a SaaS policy-issuing system and must file an annual risk assessment on the regulator's schedule. Its existing classification standard diverged from regulatory requirements, data assets were not scanned regularly, and personal information and important data were hard to pinpoint. Assessment, filing and system go-live all fell into the same quarter: the risk assessment report and the annual IT work report were due before 15 January.

What we delivered

System deployment

DataAigis Data Security & Compliance deployed with the built-in insurance template, detection rules revised for the business

Classification

30,000 core-system fields auto-tagged and reviewed by experts into an asset catalog and classification list

Risk assessment report

Following the GB/T 45577 method: 9 risk types and 18 risk sources, remediated in three stages

Policies and filing

Four policies revised and reviewed by lawyers; disaster recovery and annual work reports filed before 15 January

Deliverables

Client value

• The system stays in the client's environment: classification jobs run on a schedule and asset changes stay in sync
• Classification results drive masking: the core and policy-issuing systems mask data by account permission level
• Risk assessment, disaster recovery and annual work reports delivered together and filed before 15 January

DataAigis Data Security & Compliance is running in the client's environment, and the client plans to extend classification and masking to more systems in 2026.

Background and challenge

Multiple overseas plants, a management platform hosted in a European cloud region and a customer service center in Southeast Asia. Employee data at the European subsidiary, cross-border transfers, remote operations and website cookies were all under pressure, across GDPR, CCPA/CPRA, EO 14117, PIPL and PDPA.

What we delivered

Data map

Data flows and cross-border paths across overseas plants, the European cloud region and the Southeast Asian service center

Gap analysis and remediation

Requirement-by-requirement comparison across jurisdictions, with legal basis and priority

Cloud security and cross-border architecture

Cloud-native session management in place of a bastion host, with edge computing to reduce transfers

Legal documents

RoPA, privacy notices, DPAs, SCCs and 20+ other deliverables, issued by lawyers

Deliverables

Client value

• Avoided potential fines: GDPR fines can reach 4% of global turnover
• 300+ employees completed GDPR / EO 14117 training, building lasting capability
• Compliance preparation cut from months to weeks, at 30%–50% lower cost

From one-off consulting to long-term support: the client has renewed with DataAigis for 3 consecutive years.

Background and challenge

Connected vehicles sold worldwide generate data through in-vehicle terminals, the user app and after-sales service. European and US user data is stored in a European cloud region while R&D and customer service in China access it remotely. Privacy rules in different markets and connected-vehicle features needed to be mapped consistently and built into business processes.

What we delivered

Data map

Data flows across in-vehicle terminals, the user app, after-sales and third-party components

Gap analysis and remediation

A compliance gap report after US and EU business interviews, turned into actions item by item

Cloud security and cross-border architecture

Architecture and cloud security recommendations for EU storage with remote access from China

Legal documents

Compliance guidelines, privacy notice, terms of use, DPA, cookie policy

Deliverables

Client value

• A clear view of data flows and cross-border access across vehicles, app and third-party components
• Compliance gaps turned into concrete actions for legal and technical teams to fix together
• Documents and operating procedures for policy maintenance, request handling and incident response

All four stages (data diagnosis, legal framework, cross-border architecture, compliance operations) are complete, with 12 types of outputs and 13 documents delivered.

Background and challenge

Smart fitness hardware with facial recognition, plus an app and website for US consumers. Illinois, Texas and New York regulate biometrics specifically, and BIPA grants a private right of action. The client had an existing DPIA to review, facial data stored in public clouds, and transfers between Europe and the US.

What we delivered

Data map

How facial data moves from the device to the app, website and cloud

Gap analysis and remediation

Review of the existing DPIA and item-by-item fixes against the three states' laws and FTC expectations

Cloud security and cross-border architecture

Facial data storage recommendations; EU–US transfer architecture (SCCs + DPF)

Legal documents

Applicability analysis, terms of use, privacy notice, cookie notice, biometric consent form

Deliverables

Client value

• First answer which laws do not apply: architecture analysis narrowed the legal scope and avoided worst-case remediation
• External documents and consent flows done in one pass, so the product launched with a complete compliance file
• US-licensed lawyers and engineers issued conclusions together, turning legal advice directly into product schedules

The five deliverables from this project are now the DataAigis US Data Compliance Standard Package for companies going overseas.