Data Protection Framework

Enterprise-Grade Data Security & GDPR Alignment.

Strict adherence to the General Data Protection Regulation (GDPR) and the UK Data Protection Act is a foundational pillar of my architectural engagement model.

01. Zero-Extraction Policy

Client data is never hosted, downloaded, or replicated onto unauthorized offshore hardware. All development is performed securely via your organization's approved Virtual Desktop Infrastructure (VDI) or native cloud tenant.

02. Cross-Border Compliance

Operating from Botswana, international data processing is legally secured through the execution of Standard Contractual Clauses (SCCs), ensuring complete alignment with EU and UK data transfer regulations.

03. Principle of Least Privilege

During engagements, I request only the specific database access required to execute deliverables. Final models are deployed with strict Row-Level Security (RLS) to enforce internal data governance.

04. Data Processing Agreements

I operate strictly as a Data Processor. Your organization remains the Data Controller. All workflows are governed by a mutual NDA and DPA prior to any infrastructure auditing.

1. Roles and Responsibilities

Under the definitions of the GDPR, my consultancy acts as a Data Processor when interacting with your organization's databases and analytics platforms. The client organization retains full rights and responsibilities as the Data Controller. I do not determine the purposes or the means of processing your proprietary data beyond the scope explicitly defined in our Statement of Work (SOW).

2. Technical Security Measures

To mitigate the risk of unauthorized access, accidental loss, or data breaches, the following technical protocols are enforced across all engagements:

Multi-Factor Authentication (MFA) is strictly enforced on all developer accounts, internal communication tools, and repository access points.
No proprietary data, PII (Personally Identifiable Information), or PHI (Protected Health Information) is stored on local, unencrypted hardware.
Development and testing utilize anonymized or synthetic data sets whenever mathematically feasible.

3. Incident Response Protocol

In the highly unlikely event of a suspected data breach involving my immediate development environment or credentials, I am committed to notifying the designated Data Controller at your organization within 24 hours of discovery, allowing your organization to meet the mandatory 72-hour GDPR reporting window to relevant supervisory authorities.

4. Right to Audit

Clients retain the right to conduct reasonable audits of the development environment and access logs to ensure compliance with the executed Data Processing Agreement and NDA, provided standard written notice is given.