Use cases by sector — DSA Compliance

Education A private higher-education institution 120–180 employees

Starting need

Once past the 50-employee threshold of art. 10 of Ley 2/2023, the existing internal channel was an email address with no anonymity guarantees and no deadline control. Meanwhile, the record of processing didn't cover student and family data, some of it special category.

Solution deployed

An internal channel with technical anonymity and the art. 9.2 deadlines watched by the system, plus a record of processing rebuilt by purpose with its lawful bases and an impact assessment where required.

Whistleblowing Data protection

Logistics and transport An operator with its own fleet and several sites 250–400 employees

Starting need

Permanently mobile staff with no working-time record that would stand up to inspection, paper incident reports arriving days late, and RD 171/2004 contractor coordination handled by email with each firm.

Solution deployed

Mobile clock-in with a traceable record, on-the-spot incident reporting, a coordination file per contractor, and preventive training evidenced per person. The whistleblowing channel went live in the same phase.

Whistleblowing Data protection Health and safety Working-time records Training and Awareness

Food manufacturing A production plant on rotating shifts 90–150 employees

Starting need

Rotating shifts and overtime tracked in a spreadsheet, with no trail of corrections. CCTV and site access control absent from the record of processing.

Solution deployed

Shift-based working-time records with a tamper-proof history and minimum-rest alerts, a record of processing updated with CCTV and biometrics, and a whistleblowing channel compliant with Ley 2/2023.

Whistleblowing Data protection Working-time records

Construction A contractor with concurrent sites and subcontracting 150–300 employees

Starting need

Hours split between office and site, with manual returns per workplace. Subcontractors' employment and safety paperwork sat in shared folders with no expiry control.

Solution deployed

Working-time records per site with optional geolocation of the clock-in, a document file per subcontractor with expiries watched, and a whistleblowing channel open to staff of the other firms on site too.

Whistleblowing Data protection Working-time records

Engineering and maintenance Technical services delivering projects on client sites 200–350 employees

Starting need

Time was booked to projects in one tool and working hours in another, with numbers that didn't reconcile at audit. Role-required training couldn't be evidenced per person.

Solution deployed

One working-time record from which project time hangs, role-based training with validity and a verifiable certificate, and a whistleblowing channel with the art. 26 register ready on request.

Whistleblowing Data protection Working-time recordsProject managementTraining and Awareness

E-commerce A digital retailer with its own brand 60–100 employees

Starting need

A product recommender, customer segmentation and automated support all brought in without any inventory. Neither were the AI systems classified by risk, nor was there any record of art. 4 training under Regulation (EU) 2024/1689.

Solution deployed

An AI system inventory classified by risk with a named business owner, a fundamental rights impact assessment where required, and an art. 4 literacy campaign with a certificate per person. The record of processing was aligned with the automated decisions of art. 22 GDPR.

Data protection AI governance

Consulting A process consulting firm 80–140 employees

Starting need

A billable-hours business, with people's time scattered across spreadsheets kept by each partner. Client data circulated by email with no retention policy.

Solution deployed

Working-time records wired to project and client time, a document manager with retention by rule and legal holds, and data protection awareness campaigns for the whole workforce.

Data protection Working-time recordsProject managementTraining and Awareness

Agribusiness A commodity exporter selling into the European Union 300–500 employees

Starting need

Regulation (EU) 2023/1115 makes EU market access conditional on a due diligence statement with coordinates for every source plot. The information arrived from dozens of producers in mismatched formats and with no geometry checks.

Solution deployed

A portal for each producer to submit their plots and paperwork, automatic geometry validation on receipt, satellite checks for forest loss against the cut-off date, and a due diligence statement generated per batch, with the supplier chain vetted.

Trace DDS · EUDR Supplier vetting Data protection

One platform, eight different starting points

Starting need

Solution deployed

Starting need

Solution deployed

Starting need

Solution deployed

Starting need

Solution deployed

Starting need

Solution deployed

Starting need

Solution deployed

Starting need

Solution deployed

Starting need

Solution deployed

Which of these starting points looks like yours?