Paolo Rovatti

– DPO officially registered with the Maltese authority, IDPC. – Developed a data minimization strategy, working closely with relevant stakeholders to identify and eliminate unnecessary data collection, storage, and processing activities, thereby reducing the organization's overall personal data footprint. – Collaborated with marketing teams to implement innovative techniques for obtaining valid, explicit consent from individuals for data processing activities, ensuring compliance with consent requirements while maintaining a positive customer experience.

– Monitor compliance with regulations: keep up to date with new and changing compliance rules from regulators Autorité des Marchés Financiers (AMF), and AML requirements. Identify gaps in the company's compliance and recommend improvements. – Investigate incidents: look into potential violations of regulations or internal policies. Work with legal and other teams to take corrective actions. Suspicious Activity Reports to local FIU. – Advise management: offer compliance guidance and advice to senior management and the Board of Directors. Identify compliance risks and recommend risk-based solutions. – Manage vendor due diligence: review third party vendors and service providers for compliance and AML risk. Conduct audits of higher-risk vendors. – Financial investment advisor certification in progress (CIF).

– Responsible for developing and implementing data privacy and protection policies, procedures, manuals and best practices across an organization. Perform audits and gap analysis. – Identify and evaluate all company's data processing activity. Act as point of contact with supervisory authorities for incident reporting and Privacy rights. Design Incident Response plans. – Provide strategic data guidance to senior leadership, and instructions to our 22 focal points on conducting Impact Assessments (DPIAs). Cookie policy and consent for website compliance. – Monitor data management procedures and compliance within the company through the OneTrust® platform, a software to operationalize Data Governance, Risk, Compliance Management. – Work with other managers through projects to ensure that privacy by-default and by-design is integrated into all aspects of the organization's operations and services, at all levels. – Significant Achievements: guided the company through the intricate Trelleborg-Yokohama merger process, coordinating Data Protection Impact Assessments for each business unit involved in the merger, ensuring the mitigation of potential risks. Amended the Intra-Group Data Processing Agreement.

– Lead the overall Compliance / Privacy / AML / Risk Management program in the Company, including annual security policy review, control gap analysis audits, physical site reviews. – Design risk assessment activities across the organization, also third-party risks, through the OneTrust® platform. Platform Administrator for all data protection activities. – Collaborated with cross-functional teams to develop and implement data protection topics within multiple projects ensuring a privacy-by-design approach in the company's new initiatives. – Expertly managing the KYC processes, investigating and implementing necessary steps to align our Compliance framework with the latest recommendations issued by the EBA and FATF. – Examine escalated Anti-Money Laundering cases for RiskScreen® KYC onboarding and sanctions screening, acting as Administrator of the platform; potential breaches of UNO, EU, economic sanctions and trade restrictions. Filing of Suspicious Activity Reports to authorities. – Significant Achievements: instrumental in implementing the OneTrust risk assessment tool, saving 10 man-hours per week and providing greater accuracy. Conceptualized new Information Security Management System regulatory policy from scratch, following the ISO 27001 model.

– Implement the Anti-Corruption program for the company, including the Code of Business Ethics and Conduct (COBEC). Interpreted complex regulations and designed SOPs. – Take care of AML units escalated alerts and cases using the Refinitiv World-Check® database. Content development of Data Protection and AML training and initiatives for the whole company. – Develop action plans to address all regulatory risks, from data protection to contracts, to guarantee contracts' accuracy and on-time settlements. Effective review of raised claims. – Assisted in creating repeatable strategic solutions for management of data privacy, with identifying gaps within existing privacy programs and designing solutions to the newborn GDPR. – Managed day-to-day operations of a team of 4 Compliance Analysts, including coaching, quality control, development of performance improvement plans. Training the team. – Significant Achievements: Conducted 2 half-yearly AML / CFT & Anti-Bribery focused training sessions, presenting to ~15 participants and building team knowledge base on compliance and regulatory measures. Administered the Talent LMS platform for all related training.

– Over ten years of progressive experience as a Legal / Compliance Officer, operated in public sector projects, dealing with multiple, different stakeholders. Constantly dealing with political interference in the management of ground plans and challenges deriving from it. Examples include: building renovation projects, roadway development projects, wetland restoration project. – Represented the police force during court hearings, even in front of Administrative Tribunals, “Garante Privacy” authority, etc; developed litigation strategies for each case, providing legal advice and litigation postures to management. Processed the full range of legal documents. – Once promoted Chief Station Officer, managed up to 8 police officers + 2 computer technicians. – Significant Achievements: obtained the prestigious Criminal Investigation Officer qualification after excelling in senior academic courses. Favorable outcomes for most cases brought to court. Performed a favorable influence over working parties on aforementioned projects.