Bala Subramanyam G

Customer Success Stories

"Lead Consultant & Internal Auditor for Data Privacy & Infosec program"

-

Project brief: Data Privacy and Security advisory, implementation and internal audit for supporting large scale clinical trials, with over 100k participants for Huma Therapeutics, London (for COVID-19 Vaccine of AstraZeneca)

• Conducted briefings with the CTO about Data Privacy risks with risk management strategy
• Researched and identified comprehensive global data privacy regulations in the EU region and North Americal geographies that are barriers to go-to market
• Lead a cross functional team of 50 consisting of data Privacy specialists, cybersecurity consultants, Quality Assurance professionals and Legal counsel to design a IT-GRC program to comply with regulations related to EU-GDPR, US-HIPAA and US-FDA 21 CFR part 11
• Helped business analysts translate the regulatory requirements into technical specifications for the DevOps team to implement controls for ensuring confidentiality, Integrity and Availability of e-records and e-signatures of Clinical Trails data.

"Data protection Officer and vCISO for a Inc. 5000 Data Analytics company in the United States"

-

Project brief: The analytics company required an expert consultant to provide guidance on complying with various federal and state level data privacy regulations in the USA. Further the company is looking forward to expand it's footprint in the European Union region. The challenges are identifying key risks associated with their business model where the company acts as a data processor for several multi-billion dollar organizations in healthcare, financial services and retail

• Conducted Data Protection Impact Assessments (DPIA) or Privacy Impact Assessments (PIA) for high risk clients
• Audit readiness assessments conducted for achieving and renewal of the coveted SOC 2 Type 2 attestation from a Big-5 audit firm for 3 years in a row
• Broke regulatory barriers for the company to enter into the European Union Region by preparing for self-assessment and registration with the EU-US DPF by aligning the privacy controls for the Regulation (EU) 2016/679 (GDPR or General data Protection Regulation)
• Broke regulatory barriers for the company to enter into Switzerland market by preparing for self-assessment and registration with the Swiss-US DPF by aligning the privacy controls for FADP (Federal Act on Data Protection)
• Managed compliance with employee PII records for the company's consultants in the UK region, as mandated by the UK-Data protection Act

ISC2 Candidate (International Information System Security Certification Consortium)