Background
DGI Travel is a specialist travel management company supporting the charity, academic, and non-profit sectors. Providing fully integrated travel services, the organisation helps clients navigate complex global travel requirements, manage duty of care responsibilities, and support travellers in both familiar and remote locations.
Following an initial engagement to support due diligence ahead of a change in ownership, DGI Travel recognised a need to strengthen its internal knowledge of GDPR and data protection. As the business expanded into Europe, increased its use of AI tools, and handled increasing volumes of sensitive client data, they engaged The DPO Centre to provide specialist expertise, upskill their internal compliance function, and support evolving regulatory requirements.
Key Challenges
- Responding to due diligence requests
- Using AI tools
- Strengthening data subject rights processes
Solution
The designated Data Protection Officer (DPO) worked closely with DGI Travel to map data flows and strengthen its ability to respond to complex due diligence requests. Many of these requests arose due to the strict regulatory frameworks of EU public tenders, which required detailed, evidence-based responses within tight timeframes. The DPO identified how personal data moves across systems and third-party providers, enhanced Data Processing Agreements (DPAs) with clear contractual obligations, and provided ongoing support in managing third-party risk. This gave senior leadership the clarity and confidence to respond to client queries effectively.
To support the use of AI tools, the DPO collaborated with the Data Analytics team to assess how personal data was processed when generating and sharing email summaries globally. Data Protection Impact Assessments (DPIAs) were conducted to identify risks and implement safeguards, ensuring innovation could continue without compromising data protection standards.
The DPO also strengthened DGI Travel’s internal framework by reviewing and updating key policies, including data subject rights, retention, and international data transfers. This enabled the organisation to respond effectively to Data Subject Access Requests (DSARs), assess and manage supplier-related incidents, and provide timely, informed responses to clients. A clear, public-facing FAQ was also developed to communicate safeguards transparently to external organisations.
Outcome
Eddie Shaw, Chief Finance Officer at DGI, said: ‘This hybrid solution of internal resource with external subject matter experts worked very well for us, helped greatly by The DPO Centre’s willingness to tailor their offering to suit our needs.
‘The relationship evolved when we lost our internal Compliance Officer, with The DPO Centre seamlessly becoming more involved in our day-to-day operations. They then transitioned just as smoothly to a reduced level of support once the role was filled.
‘As a result of the support we receive from The DPO Centre, we have successfully won several large European tenders and have increased our internal capabilities regarding GDPR and data compliance.’
