Data Privacy Process Redesign for a Global Banking Leader
6 months to 6 weeks
average SLA response time
59 to 138
requests handled in the first week
65
countries and territories
The client
A global bank and financial services firm that operates in 65 countries and territories and has to follow many different data privacy laws.
The problem
An earlier attempt with a large consulting firm had not fixed how sensitive data was protected across production and non-production environments.
There was no single company-wide definition of personal data (PII).
Service levels were missing or could not be enforced.
Masking had stalled because of limited in-house skills and staff.
There was no way to check that application teams had masked their data, or to track exceptions and approvals.
What we did
Wrote a company-wide PII policy and standard operating procedures.
Set up a dedicated Data Privacy Services team to handle exceptions and support application teams.
Split requests for sensitive data into clear types for business users and the privacy team.
Launched a self-service portal on Jira Service Desk to track requests, approvals and feedback.
Introduced service levels owned by the new privacy team, with published steps for every task.
Packages: Dev and Test Privacy Process and Managed Privacy Service
The result
Average SLA response time fell from six months to six weeks.
Requests handled went from 59 to 138 in the first week.
Application teams in every region now mask sensitive data the same way.
Every masking request can be followed live in the portal.
Data protection steps are part of the software development lifecycle.
Tools and systems
A self-service portal on Atlassian Jira Service Desk.