From Spreadsheets to a Scalable Privacy Programme — In Six Weeks

Case Study | Life & Health Reinsurance | OneTrust Data Mapping & DPIA Automation

The client is a specialist life and health reinsurer operating in the UK market. Operating at the intersection of insurance, financial services, and health data, the organisation processes substantial volumes of sensitive personal data — including special category health information — on behalf of cedants and their policyholders. In this position, data privacy is not simply a compliance obligation; it is a direct operational risk. Regulatory scrutiny of the life and health reinsurance sector has intensified as the ICO and FCA align their expectations around data governance and accountability frameworks. Any gap between policy intent and documented, auditable practice carries meaningful regulatory and reputational exposure.

The organisation’s existing approach to data protection impact assessment was built around a manually maintained PIA spreadsheet. While this had served as a starting point, it offered limited scalability, no automated workflow, no audit trail, and no systematic linkage between processing activities, assets, legal entities, and associated risks. As processing volumes grew and the regulatory expectation of accountability under UK GDPR crystallised — particularly around Articles 30 and 35 — reliance on a static document created compounding risk.

The core problem was not a lack of awareness but a lack of infrastructure. The organisation needed to transition from ad hoc documentation to a governed, repeatable programme that could demonstrate compliance readiness under scrutiny. Without a structured data inventory and automated DPIA workflow, each new processing activity required manual effort with no consistency, risk flagging, or escalation path. The longer this approach persisted, the wider the gap between regulatory expectation and operational reality.

DPG delivered this engagement as a Fast Start implementation — a structured, time-boxed approach designed to deploy a working, configured OneTrust environment in weeks rather than months, without sacrificing quality or tailoring.

The project was structured across four two-week sprints, beginning with a Sprint 0 initiation phase to establish governance, agree dependencies, and confirm project team responsibilities on both sides. This foundation sprint is often underestimated in importance; in practice, it is what prevents the later sprints from stalling on discovery rather than delivery.

Sprint 1 focused on information gathering and customisation. DPG worked with the client to capture the specific organisational inputs required to configure the platform to their context: departmental structures, purposes of processing, data subject volume thresholds, and the client’s existing PIA questionnaire. The client’s questions were reviewed and selectively incorporated into the agreed assessment templates, ensuring continuity with existing practice rather than a disruptive reset.

Sprint 2 built out the full assessment template suite: the Processing Activity Assessment, Asset Assessment, and Legal Entity Assessment within the Data Mapping module, and the DPIA, TIA and LIA templates within Assessment Automation. Each template was configured with conditional logic, question hints, inventory relationship generation, and — for the DPIA — risk flagging with assigned approver and owner roles calibrated to the client’s risk appetite.

Sprint 3 completed the engagement with automated reporting, Self-Service Portal configuration, branding application, and the provision of full handover documentation. Formal sign-off was obtained at the close of each sprint milestone.

The engagement was built on the OneTrust platform, specifically the Data Mapping and Assessment Automation modules. OneTrust was selected as the implementation environment because it is already licensed by the client and provides the audit trail, workflow automation, and regulatory reporting capabilities that manual processes cannot replicate.

The Data Mapping module provides the structured inventory layer — recording processing activities, assets, legal entities and vendors in a linked, searchable format that directly supports Article 30 compliance reporting. The Assessment Automation module automates the DPIA, TIA and LIA lifecycle: triggering follow-up assessments based on conditions identified in the Processing Activity Assessment, routing risks to the correct approvers, and maintaining a documented audit trail throughout.

The Self-Service Portal was configured to allow OneTrust users to initiate and complete assessments independently, reducing the administrative burden on the privacy function and enabling the programme to scale without proportionate headcount growth.

DPG delivered a fully configured OneTrust environment, operational from day one of handover, including:

A configured Data Mapping module with three assessment templates (Processing Activity, Asset, and Legal Entity), each containing structured question sets, conditional logic, attribute groupings, and automated follow-up rules — enabling the client to build and maintain an Article 30-compliant data inventory at scale.

A configured Assessment Automation module with DPIA, TIA and LIA templates, incorporating the client’s own risk appetite calibrations, risk flagging, and assigned approver and owner roles. The DPIA template was specifically aligned to UK GDPR Article 35 requirements, with risk sections reviewed and configured to reflect the client’s operational context rather than a generic out-of-box template.

Automated report templates pulling data directly from completed assessments, covering the GDPR articles most relevant to the organisation’s processing activities. A configured Self-Service Portal enabling business users to access and complete assessments independently. Full branding applied to the OneTrust tenant and email templates. Comprehensive handover documentation covering all artefacts created and configuration decisions made.

The most immediate commercial impact of this engagement is the elimination of the organisation’s single largest data protection compliance risk: the reliance on an unstructured, manually maintained PIA spreadsheet with no audit trail, no workflow governance, and no scalability.

Where previously each DPIA required manual effort to initiate, track, and document, the organisation now operates an automated workflow that routes assessments, flags risks, assigns owners, and maintains a complete audit record — without manual orchestration. This reduction in friction removes a material barrier to compliance: organisations that find compliance burdensome tend to defer it. Removing that friction makes good practice the path of least resistance.

The Article 30 Records of Processing Activities — previously absent as a structured, maintained register — now exists as a living inventory within OneTrust, directly linked to assets, legal entities, and associated assessments. This positions the organisation to respond to an ICO enquiry or internal audit with evidence rather than reconstruction.

The engagement was designed and priced as a Fast Start, delivering a production-ready implementation in six weeks. This model provides early ROI without the cost and delay of extended implementation programmes, while the platform architecture ensures the programme can scale as the organisation’s data processing footprint grows. The Self-Service Portal specifically reduces ongoing dependency on the privacy team for routine assessment initiation — a genuine operational efficiency gain.

Life and health reinsurers occupy a distinctive position in the data protection landscape. They process sensitive health data at volume, often at one or more removes from the original data subject relationship, and they do so within a regulatory environment shaped by both the ICO and, increasingly, the FCA’s operational resilience expectations. The consequence of inadequate data governance in this sector is not merely a regulatory fine — it is reputational exposure with cedants, counterparties, and regulators simultaneously.

The pattern this engagement addresses is common across the sector: organisations that have grown quickly, taken compliance seriously in principle, but allowed the infrastructure to lag behind intent. A spreadsheet that was fit for purpose three years ago is not fit for purpose today. The cost of closing that gap proactively — through a structured, time-boxed Fast Start — is significantly lower than the cost of closing it reactively, under regulatory pressure, or following a data subject complaint.