Data Discovery & Risk Assessment: We began by auditing the flow of personal data across the event lifecycle — from registration to evaluation. This included identifying data types collected, storage systems used, and access levels granted to stakeholders. Potential vulnerabilities and non-compliant practices were flagged early.

Consent Management & Access Control: We implemented a consent-first approach, ensuring participants and guardians understood how their data would be used. Access rights were mapped based on roles, and a tiered system of authorization and authentication was enforced for data handlers across departments.

System Integration & Security Protocols: Collaborating with technical teams, we embedded data protection measures directly into event submission and processing platforms. This included encryption of sensitive information, secure storage, and logging of access attempts — following industry-standard privacy-by-design principles.

Monitoring & Incident Readiness: Throughout the event duration, we continuously monitored data flows and access patterns to detect anomalies or potential breaches. A response plan was put in place, with quick protocols for reporting, containment, and notification in case of privacy incidents (thankfully, never triggered).

Documentation & Compliance Alignment: We developed and shared internal privacy documentation, ensuring all processes aligned with applicable laws and internal data handling policies. This helped ensure legal defensibility and transparency, especially during the evaluation and result declaration stages.