DataAigis
Data compliance consulting

Data compliance consulting

Regulatory inspections in China, and compliance for going global to the EU, UK and US, with remediation you can evidence. Licensed lawyers and engineers on one team, from legal interpretation to architecture changes to evidence.

Book a free 30-minute diagnosis

Three situations, one question from the regulator

Where your data sits, who accesses it, on what basis, and what evidence you can produce when something happens. Triggers and jurisdictions differ; it always comes down to which policies changed, which systems changed, and what evidence was kept.

Inspections in China

Finance & insurance · Automotive · Energy · Government

  • Banks and insurers file an annual risk assessment before 15 January
  • Doc No. 93 self-inspection, classification, risk assessment and remediation
  • Data export: security assessment, standard contract filing, PI protection certification
  • Deliverables ready for regulatory filing
Bank & insurer risk assessment Cross-border data transfer

Foreign companies in China

Automotive · Pharma · Manufacturing · Insurance · Tech

  • Headquarters' control framework landed in China; one set of facts must pass both regulators and group audit
  • Focus on data export, cross-border access and localisation
  • Bilingual deliverables for the local team and headquarters
Cross-border data transfer

Going global

Smart hardware · SaaS · Cross-border e-commerce · Automotive · Embodied AI

  • EU / UK: GDPR / UK GDPR, RoPA, DPA, SCCs / IDTA
  • US: federal and state privacy laws, BIPA, EO 14117
  • Southeast Asia PDPA, the Middle East
  • Fixing the architecture before launch costs far less than reworking it after
GDPR compliance US data compliance Industry-specific compliance

Questions that take both law and engineering to answer

Where does the data sit?Who is accessing it?Whose components are you using?Where do your people serve customers?The data tail of devicesWhat can you show when something happens?

A compliance assessment answers a chain of technical and business choices. The answers shape system architecture, not just a report.

See what each question involves

Five steps, four to six weeks

  1. 01

    Interviews and research

    Separate interviews with business, product, IT and legal to map the business architecture, systems and real data flows.

  2. 02

    Data map and scanning

    Asset inventory and classification tagging, identifying cross-border paths, third-party components and sensitive fields.

  3. 03

    Gap analysis

    Item-by-item comparison against target jurisdictions, with risk ratings, legal basis and remediation priorities.

  4. 04

    Remediation and hands-on support

    Policy and privacy document set, architecture and cloud configuration baselines; we make the changes we can and give executable plans for the rest.

  5. 05

    Re-assessment and evidence

    Verification and retesting after remediation, with indexed evidence ready for inspections and enquiries.

4–6 weeks
Standard project cycle, adjusted by jurisdictions and entities
20+
Standard deliverables: policies, reports, data maps, configuration baselines
5 steps
A closed loop, not just a report
Bilingual
Chinese and English, for local teams and headquarters

Remediation advice lands on three layers: the app (SDK choices, permission requests, consent flows), the back end (where data is stored, how logs are split, where the cross-border link is cut) and cloud configuration (encryption, data residency, IAM and operation logging). Every recommendation carries its legal basis, scope of impact, priority and owner.

The system takes on repetitive work and compliance experts focus on judgment and sign-off; deliverables are reviewed by licensed lawyers, not a substitute for their signature.

Deliverables

Legal (issued by lawyers)

  • RoPA (records of processing)
  • Privacy notice, terms of use, cookie policy
  • DPA, SCCs / IDTA
  • Data security policies and procedures
  • Compliance guidelines, DSR and incident response SOPs
  • Applicability opinions (e.g. where BIPA applies)

Technical

  • Data map and asset catalog
  • Gap analysis and remediation advice
  • Risk assessment report
  • Cloud security recommendations
  • Cross-border transfer architecture recommendations
  • SDK audit

Drawn from delivered projects; the exact list depends on target jurisdictions and entities.

Two stages, three ways to work with us

Stage 1 · Assessment and remediation

4–6 weeks

Interviews, data map, gap analysis, remediation and re-assessment, ending with a complete package you can hand to the regulator.

Stage 2 · Continuous compliance

Annual

Regulatory tracking, asset monitoring, evidence trails, annual re-assessment; optional 1–2 experts remote or on site.

Consulting projects can be bought on their own; the system is not a prerequisite. Consulting, system and operations can also be combined into an annual service.

See packages and ways to work with us

Related cases

A leading life insurer

System plus a year-round on-site team; the client bought two phases in succession

A foreign-invested P&C insurer

System go-live, annual risk assessment and filing before 15 January, within one quarter

A multinational manufacturer

Multi-jurisdiction compliance across China, Europe, the US and Southeast Asia; three consecutive years

A connected-vehicle maker

Four-stage engagement delivering 12 categories of outputs and 13 documents

A smart fitness hardware maker

Its five-part delivery became our standard US data compliance package

FAQ

What does data compliance consulting cover?
Five steps: interviews and research, data map and scanning, gap analysis, remediation with hands-on support, and re-assessment with evidence. Deliverables include policies and privacy documents issued by lawyers, plus technical outputs such as data maps, gap analyses and cloud and cross-border architecture advice.
How long does a project take?
A standard project runs 4–6 weeks, adjusted by jurisdictions and entities. After assessment and remediation it can continue as an annual compliance service.
Do we have to buy the system?
No. Consulting projects can be bought on their own and scanning can use our tools; whether to deploy the system is the client's call, and it can follow a consulting project.
Who issues the deliverables?
Legal deliverables are issued by licensed lawyers and can be signed and stamped; technical deliverables come from engineers, ready for product and IT to schedule.
Can China and overseas compliance be done together?
Yes. All three situations come down to the same three things: which policies changed, which systems changed, and what evidence was kept. Lawyers and engineers work as one team, and deliverables are bilingual.
How is it priced?
Quoted by jurisdictions and entities in scope. You can start with a free 30-minute diagnosis to see what must be done this year and what can wait.

Start with a free diagnosis

A 30-minute call to scope your business and target markets, and decide what must be done this year and what can wait.

Book a free diagnosis