Timea Szabo

• Act as external DPO for fintech startups with international client bases and cloud-first environments, as well as accountancies, law firms and charities. • Advise on global data transfer strategies involving US (e.g. Google, AWS), India (outsourced tech), Canada (CRM), Australia (payment gateways) using SCCs, IDTAs and DPIAs. • Advise on DORA’s overlap with the GDPR and help design privacy-compliant procurement and outsourcing processes in line with both DORA and GDPR • Engage directly with ICO and CNIL on behalf of clients during complaints, breach notifications, and Article 30/35 queries. • Implement Privacy by Design in mobile apps and APIs, ensuring consent, transparency, and user rights alignment. • Conduct due diligence on vendors based in high-risk jurisdictions; assess ISO 27001, SOC 2 Type II, and processor obligations. • Review privacy language in client and supplier contracts; negotiate DPAs and addenda for cross-border services. • Assist US-headquartered clients in aligning their practices with UK/EU GDPR through tailored documentation and training.

• Led group-wide privacy transformation through the full implementation of a privacy framework from just bare bones for eight fintech/payments entities across UK and international markets. • Developed and enforced privacy protocols for relationships with third parties in the US, Canada, Uzbekistan and Australia. • Drafted and implemented SCCs/IDTAs for transfers to vendors and partners including CRM, customer service and payment platforms. • Submitted DPIAs involving biometric KYC, fraud monitoring, and geolocation tracking. • Aligned marketing practices with PECR and cookie requirements; redesigned consent architecture for multiple domains. • Maintained open lines with the ICO for pre-emptive advice and formal breach notifications when needed. • Collaborated with cross-functional teams (legal, product, engineering, infosec) to embed privacy into digital product development, procurement and to foster understanding and compliance.

• Delivered DPO-as-a-Service to clients with operations in the EU, UK, North America, and APAC. • Supported fintech, SaaS, and health sector clients with global compliance programs, especially around marketing data flows and cloud hosting abroad. • Managed ICO relationship on behalf of client; guided on data mapping, ROPA, DPIAs, DPAs and legitimate interest assessments. • Advised UK-based firms on transferring data to Indian outsourcing vendors and US-based analytics platforms.

• Led GDPR and information governance implementation in a UK-regulated body. • Responded to ICO audits, breach investigations, and policy feedback. • Reviewed contracts with local and international suppliers, drafted new DPAs, introducing SCC-based clauses and minimum-security requirements.

Associate in the Authorisations and Supervision Division.

Compliance advise, general insurance, mortgage protection, quality assurance and performance management, process development and implementation.

Investigation of potential breaches of ss19 and 21 of the Financial Services and Markets Act 2000 (boiler room and recovery room activities); utilisation of internal and external databases for investigation and analysis purposes, document review, report writing, cooperation with the City of London Police, the Serious Organised Crime Agency and international financial services and banking regulators to prevent financial crime and aid prosecutions.

Reviewed and improved complaint handling processes and policies. Developed Subject Access Request processes and training manuals, trained and continuolsy coached and motivated internal and external teams to meet quantitative and qualitative targets. Successfully built relationships with internal stakeholders to achieve the implementation of work processes designed for my team in order to help us meet SAR deadlines. Monitored workload and processes to ensure DPA deadlines were met. Reported and documented any breaches that occurred.

Business Crime and Regulations Paralegal; financial crime, boiler room fraud, carousel fraud, FSA, HMRC, SOCA investigations.