Yassine Mernit

♦ Ensured GDPR compliance for data transfers in the context of a global merger; drafted and coordinated the Global Sharing Agreement. ♦ Drafted and implemented corporate privacy policies and procedures. ♦ Acted as local privacy point of contact across 18 countries (France, UAE, Greece, Germany, Ireland, Denmark, Morocco, Algeria, Serbia, Sweden, Finland, Norway, India, Brazil, Romania, Turkey, etc.) for operational deployment of the privacy framework. ♦ Conducted Privacy Impact Assessments (PIAs) for all applications and systems across local entities and the Holding. ♦ Supported the innovation team at Ayvens HQ for GDPR compliance of connected cars projects. ♦ Coordinated awareness, training and animation of the Data Protection community (CDOPA & LOD1).

Providing strategic consulting and operational support for GDPR compliance, data protection governance, and regulatory transformation programs across multiple sectors.

♦ Drafted and submitted the annual GDPR accountability report for the internal DPO. ♦ Reviewed and validated the full register of processing activities (ROPA) in coordination with business stakeholders (DPR OT questionnaires). ♦ Oversaw the completion and validation of PIAs, acting as internal privacy advisor. ♦ Managed personal data breach situations: stakeholder coordination, ENISA impact assessment, CNIL notification, and data subject communication. ♦ Participated in legal negotiations (clients/suppliers) on GDPR responsibilities (joint controllers, processors). ♦ Conducted third-party GDPR audits: created and reviewed questionnaires, analyzed results, and followed up with remediation plans. ♦ Acted as GDPR lead for the local entity during the ALD / LeasePlan merger, supporting data sharing agreements and governance (GSA / Deed of Adherence). ♦ Led GDPR awareness initiatives and animated the internal Privacy Community (CDOPA). ♦ Defined privacy-by-design procedures and monitored data protection issues and remediation plans. ♦ Handled data subject rights (DSRs) requests in line with GDPR obligations.

♦ Led the GDPR compliance program as external DPO. ♦ Performed a full GDPR audit and assessed current data protection practices. ♦ Built the data processing inventory and ROPA (Records of Processing Activities). ♦ Defined the GDPR roadmap and delivered key documentation: ♦ Awareness & training materials for all staff ♦ Data protection policy, PIA procedures, consent withdrawal forms ♦ Roles & responsibilities matrix (controller vs. processor) ♦ Privacy notices, DSR handling procedures, data breach notification templates ♦ Cross-border data transfer policies and technical & organizational measures ♦ Reviewed contracts and internal processes to ensure regulatory alignment. ♦ Drafted and implemented data protection procedures across web platforms, HR, and IT systems.

♦ Led a security compliance project under the French General Security Framework (RGS). ♦ Conducted EBIOS RM risk assessments through workshops and threat modeling. ♦ Delivered risk analyses, impact studies, and compliance evaluations for the organization’s critical information systems. ♦ Focused on aligning cybersecurity and personal data protection controls.

♦ Conducted RGS compliance analysis and risk assessments using EBIOS RM methodology. ♦ Delivered strategic and operational scenarios for risk treatment. ♦ Performed data protection impact assessments (DPIAs) aligned with GDPR, including security and legal risk analysis.

♦ Led GDPR compliance projects in collaboration with the Group Data Protection Officer. ♦ Managed the OFAC/EWRA compliance project for international banking operations. ♦ Conducted a feasibility study for a data reporting tool to interface with US authorities (FED): designed automation of data collection workflows. ♦ Managed the implementation of a shared screening platform (FIRCO) for multiple entities across France, Germany, Italy, Spain, and Poland. ♦ Oversaw version upgrades of internal banking software (EVOLAN & COLLECTION – Sopra Banking Software): • Collected and analyzed business needs • Facilitated workshops with stakeholders and vendors • Drafted test plans and user guides • Managed UAT (User Acceptance Testing) and change management activities

♦ Acted as business consultant (AMOA) supporting the Operational Risk, Permanent Control, and Internal Audit departments. ♦ Led the convergence project of risk registers across 3 control functions using the ENABLON platform. ♦ Participated in executive committees as the business lead for operational risk and permanent control. ♦ Collected and analyzed business needs, assessed existing processes, and coordinated with ENABLON to define system evolutions. ♦ Contributed to process modeling, functional design, testing phases, and change management activities.

♦ Conducted a GDPR compliance audit focused on the processing activities of international subsidiaries. ♦ Supported the implementation and configuration of the OneTrust privacy management platform. ♦ Completed and structured the Records of Processing Activities (ROPA) within OneTrust. ♦ Performed gap analyses to assess GDPR compliance status and identify remediation actions. ♦ Contributed to the preparation of key compliance deliverables: • Sub-processor register • Risk register • Data protection procedures ♦ Participated in steering and security committees to ensure alignment with group data protection strategy.

♦ Supported the organization in its GDPR compliance journey, working closely with the Legal and IT departments. ♦ Conducted a full audit of data processing activities across operational departments. ♦ Built the Records of Processing Activities (ROPA) and updated data mapping documentation. ♦ Drafted key GDPR deliverables: privacy policies, data breach procedures, data subject rights processes. ♦ Provided training and awareness sessions for internal staff on data protection principles. ♦ Delivered recommendations for the implementation of technical and organizational measures.