Challenge
Sponsors required evidence that patient data was protected across sites and sub-contractors, under both GDPR and India's DPDP Act, but vendor oversight was informal.
Approach
We built a vendor risk tiering and assessment process, mapped data flows across sites, set breach-notification playbooks to the 72-hour expectations, and added external attack-surface monitoring.
Outcome
Typical outcomes: a repeatable supplier assessment, documented data flows for sponsor audits, and tested breach-notification steps.
This is an anonymised, representative scenario based on the type of work we do in this sector. It does not describe a specific client or guarantee a specific result.