Case studies: matters from my practice.

Long-term data protection support for the Polish unit of an international group

Client

The Polish unit of a foreign group in the healthcare sector.

Challenge

Every year the group has an external auditor check GDPR compliance. The local organisation needed someone to run data protection between audits, respond to findings and speak to the group in its own language.

1. For several years I have acted as the external data protection representative. I run the entire engagement in English, in direct contact with the group and its auditor.
2. I took the organisation through five group audit cycles and closed the findings after each one.
3. I rebuilt the documentation from the ground up: a data protection policy with a full set of procedures, from retention and breaches to DPIA and oversight of processors.
4. I put in order data transfers within the group and to providers outside the EEA, data processing agreements and the rules for remote work.

Safe rollout of an AI assistant in regulated organisations, including the financial market

Combined description: experience from several generative AI rollouts.

Client

Regulated organisations, including financial market institutions supervised by a sector authority.

Challenge

The organisation wants to bring an AI assistant into its office tools: email, documents and meetings. The assistant sees everything the user can access, and a supervised entity answers to its supervisor for professional secrecy, ICT security and client data.

1. I carry out a data protection impact assessment of the whole office platform and a separate, in-depth DPIA of the AI assistant itself, following the organisation's methodology.
2. I assess the rollout against DORA, NIS2 and sector secrecy rules, together with the cloud terms of use and the provider's chain of subcontractors.
3. I write the AI use policy, the accountability model for the tool and the AI literacy training programme for staff.
4. I prepare a set of go-live conditions: each condition has an assigned piece of evidence and a test, and the result is binary.

An interview-based organisational and compliance audit and a procedure manual

Client

A multi-branch services group employing several thousand people.

Challenge

Procedures existed partly on paper and partly in the heads of regional managers. The board wanted to know how the company really works.

1. I conducted 51 interviews with management and staff.
2. On that basis I prepared a report for the board with 15 findings, each with its exposure, a remediation path and a 0-180 day plan.
3. I produced 9 as-is process maps and a critical review with 46 observations.
4. I wrote a manual of 75 procedures in 12 areas (49 from scratch, 26 rebuilt), each in the same 11-point structure, with a list of 466 questions for the organisation, 95 of which block implementation.

Job evaluation before pay transparency becomes mandatory

Client

A large employer in the services sector with several thousand employees.

Challenge

The Pay Transparency Directive requires pay differences between jobs to follow from objective criteria. The employer wanted this ready before the rules start to apply.

1. I built a point-factor method: 13 criteria, a pool of 1,000 points, and a valuation calculated the same way every time, with no discretion.
2. I drew up a catalogue of 46 jobs, valued 25 of them and arranged a grid of 7 grades.
3. I prepared job cards for managers and a pay gap test.
4. I presented the methodology and the results to the board.

AI literacy that stays in people's heads, not in the slide deck

Combined description: several training programmes.

Client

Boards, IT and HR departments and operational teams in organisations that are rolling out AI.

Challenge

The AI Act requires anyone who uses AI to ensure that staff have sufficient knowledge of the technology. Most training ends with a lecture on the rules, after which nobody knows what they may type into the chat window.

1. I build training around the tools the team actually uses, with examples from its day-to-day work.
2. I rely on exercises instead of lectures: participants check for themselves what may be shared with AI, spot risky prompts and practise responding to an incident.
3. I run a separate programme for branches: how to recognise a personal data breach and what to do in the first hour, tested on real scenarios.
4. Every team leaves with a one-page cheat sheet that stays on the desk after the training.

Data transfers outside the EEA in international groups and with AI tools

Combined description: experience from several projects.

Client

International groups and organisations using the cloud and AI tools.

Challenge

Data flows to the parent company, to the cloud provider and to the AI model provider. Each flow needs a legal basis and an assessment of whether the law of the recipient's country undermines it.

1. I mapped the data flows and assigned each one a basis: an adequacy decision or standard contractual clauses.
2. I prepared transfer agreements and a record of processing activities for intra-group flows.
3. I carried out transfer impact assessments for providers outside the EEA.
4. For AI tools I analysed the provider's subcontractors, where data is processed and the rules for notifying changes.