Recovering a Regional Data Privacy Programme
Bushey Advisors transformed a stalled Data Privacy & Protection initiative into a successful regional programme.
Recovery
Restored
Overview
The Bushey Advisors were contacted by this APAC blue-chip Financial Services business to provide leadership and support to recover a stalled DPP Programme. Initially set up and commenced by the internal staff, the Programme had stalled with the team uncertain on the direction or solution for the Programme.
The aim of the Programme was to label all unstructured files across seven jurisdictions, with an initial file count of approximately 100 million files.
The original Programme Team had engaged a third party to undertake the labelling exercise in six of the seven countries. The Agreement between the third party and the client was found to be unsuitable for either party and did not cover the requirements.
The entire process with improvement was replicated for another 100 million files for the seventh country.
A blue-chip financial services company in the Asia-Pacific region, offering a variety of financial services products. It leverages digital tools for innovation and sustainability, serving key markets including Australia, Hong Kong, and Japan, with a focus on customer experience, risk management, and community engagement to support comprehensive financial planning and resilience.
To label 200 million unstructured files across seven countries in compliance with the organisation's Data Privacy Policy.
A third party was engaged to develop the scripts required to identify, label and report on the labelling exercise.
Labelling was run across the six countries, with the seventh country coming onboard later in the Programme.
TESTIMONIALS
The collaborative efforts between the Bushey Advisors, the Third Parties, and our Regional teams have established a strong foundation for our data governance activities across our APAC business units. The implementation of data classification, retention controls, and secure migration has significantly improved our compliance posture and operational resilience. I would like to thank the programme team for their professionalism, adaptability, and commitment to helping recover the programme and delivering great results.
Why Bushey
Independent programme leadership
01Regional stakeholder coordination
02Vendor remediation expertise
03Data governance experience
04Transformation recovery capability
05The Challenge
What stood in the way
Stalled DPP ProgrammeA leading APAC Financial Services business faced a stalled Data Privacy & Protection programme. The initial approach lacked governance, a clear solution design, and an effective third-party agreement, resulting in misalignment and inefficiency, with the internal team uncertain on direction.
Multi-Country CoordinationThe programme needed to classify 200 million unstructured files across seven countries, each requiring classification and retention controls. The sheer volume, alongside password-protected, corrupted, and access-controlled files, posed a significant governance and coordination challenge.
Ineffective Vendor ArrangementThe contract with the major IT service provider did not meet the programme's needs. The third party required extensive guidance, prompting Bushey Advisors to step in, redesign the solution, and renegotiate the agreement to serve both parties' interests within the remaining budget.
How Bushey solved it
PROGRAMME RESETThe Bushey Advisors halted the programme, redesigned the solution and renegotiated the third-party agreement.
OPERATING MODEL REDESIGNThe solution developed by Bushey Advisors, leveraging the programme's team and resources, centred on the Microsoft Azure Information Protection (AIP) tool.
VENDOR REALIGNMENTThe third party developed scripts to scan folders in scope, apply business-provided labels, rescan all files post-labelling for team approval, and label missing or incorrectly labelled files without affecting last-accessed dates.
GOVERNANCE CONTROLA Data Archive/Retention Tool was implemented to remove files outside each country's Data Retention Policy. Files not accessed in 10 years (as low as 2 years in some countries) were archived, with a 'stub file' left in place to trigger restoration if needed. Regular scans and archiving reports were sent to country administrators.
SCALED DELIVERYThe entire process was replicated with a different third party for the seventh country. Improvements were made to the scripts, and scanning and labelling times were greatly reduced.
When Transformation Stalls
Independent programme leadership to restore confidence, rebuild momentum and deliver outcomes at scale.
Let's Discuss Your RequirementsThe Outcome
Reducing the overall file count by nearly 50% cut run times for DPP file scanning and data backup sequences, and reduced ongoing costs for storage hardware and maintenance.
Regular reporting of exceptions was passed to the Information Governance Officer for review, bringing each business back within their regulatory compliance requirements.
Confidential data can now be automatically protected from leaving the business platforms — whether by copying files to local devices or emailing them to personal accounts.
Through renegotiating the agreement with the main third party, the restructured Programme delivered a saving of USD 200k.
Business teams were encouraged to clean up their unstructured data storage areas across on-prem fileservers and SharePoint, taking ownership of their data governance.
Implementing tools and a Retention Policy enforced the archival and removal of files that had not been opened for many years — removing between 30% and 60% of all unstructured files from local storage.
Client successfully delivered the programme after engaging Bushey. Subsequently Bushey continued to lead the next stage of the programme.
Programme Off Track?
Need independent leadership to recover a complex transformation?