Case Study · Data Protection Impact Assessment

Strengthening Data Protection Governance for an Organization Supporting Women in Tunisia

A practical data protection program to help protect highly sensitive personal data and establish shared responsibilities as the organization expanded its work with institutional partners.

Service Data protection training, compliance assessment & governanceFrameworks GDPR · Tunisian Organic Law No. 2004-63Client Details withheld for confidentiality

The Challenge

An organization dedicated to the social and economic empowerment of women was processing highly sensitive personal data, including information relating to vulnerable individuals. As the organization expanded its activities with institutional partners, it needed to strengthen its data protection practices, align with applicable legal requirements, and establish a governance framework that protected the rights and privacy of the people it serves. The initiative brought together civil society organizations and representatives from the Ministry of Social Affairs, requiring a common understanding of data protection responsibilities across multiple stakeholders.

Our Approach

A comprehensive program combining legal expertise, governance and operational implementation

01

Data Protection Training

Practical workshops for civil society organizations and public sector stakeholders covered:

  • GDPR principles and obligations
  • Tunisian Organic Law No. 2004-63
  • Roles and responsibilities when processing personal data
  • Practical guidance for handling sensitive information securely

The objective was to translate legal requirements into day-to-day operational practices.

02

Compliance Assessment

A structured assessment of the existing data protection framework evaluated:

  • Governance arrangements
  • Data processing activities
  • Internal procedures
  • Organizational responsibilities
  • Compliance gaps

Findings informed prioritized recommendations tailored to the operational realities of the civil society sector.

03

Data Governance Framework

A comprehensive data protection procedures manual was developed to support long-term compliance, covering:

  • Personal data lifecycle management
  • Access control responsibilities
  • Confidentiality requirements
  • Incident reporting
  • Data retention
  • Secure handling of sensitive information
  • Internal governance processes

The framework was designed to be practical, sustainable and adaptable as the organization evolves.

Article 35 DPIA

A four-part assessment

We assessed personal data processing context, compliance with principles and rights, and risk to data subjects.

01 / CONTEXT

Map the processing

Catalogue every category of personal data collected — identity, health, violence accounts and perpetrator data — who accesses it, and how it moves through intake, casework and referral.

02 / PRINCIPLES

Test against GDPR

Evaluate legal basis, necessity, proportionality, minimization and retention for each processing activity against Articles 5, 6 and 9.

03 / RIGHTS

Check data subject rights

Assess whether consent, access, rectification, erasure, restriction, objection and portability can actually be exercised, plus subprocessor terms under Article 28.

04 / SECURITY

Model the risk

Score realistic threat scenarios — illegitimate access, unauthorized modification and data loss — for severity and likelihood before and after mitigation.

Process Mapped

How a case moves through the center

Every stage where personal data is created, discussed or shared formed the backbone of the risk assessment.

01

Intake

Identity, contact and initial situation

02

Listening & assessment

Sensitive detail intake

03

Case reports

Social, legal and psychological notes

04

Referral

To legal, medical and institutional partners

What We Found

Three risks, mapped and moved

Severity × likelihood matrix. Before-and-after severity ratings are shown beside the matrix; the case study does not publish likelihood coordinates for the individual risks.

SEVERITY →

Severity increases left to right; likelihood classes run negligible to maximal from bottom to top. The case study does not specify the three scenarios' likelihood coordinates, so their exact cells are not marked.

Before After proposed measures
1Illegitimate access to case filesMAXIMAL→IMPORTANT
2Loss or destruction of recordsMAXIMAL→IMPORTANT
3Unauthorized data modificationIMPORTANT→LIMITED

No risk retained a maximal rating after the proposed measures were modeled. The two risks with the highest inherent impact — illegitimate access and data loss — settled at a moderate residual severity, an honest reflection of scenarios where the potential harm stays significant even once mitigations are in place. The remaining risk moved into the low-risk range.

The Roadmap

A plan across four tracks

Governance & compliance

  • Register of processing activities
  • Internal data protection policy
  • Defined retention schedules
  • Signed confidentiality charter

Organizational measures

  • Written, signed consent forms
  • Plain-language privacy notice
  • Data-subject-rights process
  • Annual staff training

Technical measures

  • Role-based access + MFA
  • Encryption & pseudonymization
  • Local + encrypted cloud backups
  • Locked storage, secure disposal

Risk & incident management

  • 72-hour breach response plan
  • Annual compliance audit
  • Privacy by design for new tools
  • Yearly DPIA re-assessment
Outcome

Every risk out of the red zone

The assessment provided an owner-assigned, sequenced plan for turning protective intent into durable practice. The proposed mitigations reduced the modeled risks; the roadmap describes planned measures, not a claim that every measure had already been implemented.

Data Protection Impact Assessment · Conducted under Article 35 of the GDPR · Client details withheld for confidentiality