← All work Mahdi Fazel Book a call
Project · Compliance, privacy and InfoSec

DataGuard

Three platforms, one source of truth. I designed across Privacy, Information Security and Compliance for more than 4,000 organisations, and cut reporting time by 45 percent.

One reporting cycleIllustrative
A reporting cycle before and after the shared model Before, a report is assembled separately from Privacy, InfoSec and Compliance and then reconciled. After, one view built on the shared model takes 45 percent less time. Before · three surfaces Privacy InfoSec Compliance Reconcile After · one model One view −45% Start Report ready

One measure, computed once rather than three times.

Reporting time
−45%
days of assembly turned into a view
Organisations
4,000+
across the three platforms
Countries
50+
regulatory contexts in scope
Role
Product Designer
Duration
2020 to 2023
Industry
Compliance · Privacy · InfoSec
Deliverables
System · Product · Motion
Mahdi Fazel · @mafazeluxui

Compliance work, from the audit to the annual report

The Privacy Audit walkthrough: data gathering per department, each one starting from its own process selection.

The DataGuard platform on a monitor, with contract details, a health score and a customer experience card from the reporting view in front of it, under the line: protect the people behind the data.
The DataGuard annual privacy report for 2021, with the solution overview letter and the data subject request pages beside it, in German.

Audit walkthrough

The problem

Three products, and no agreed answer

Users were not asking for more dashboards. They were asking for one truth.

Compliance officers, consultants and sales leaders worked across three separate DataGuard surfaces: Privacy, Information Security and Compliance. The data models underneath them had diverged, and reporting was disconnected across all three.

Reporting cycles consumed days. By the time a report was assembled, the decision it was meant to support had already been made without it.

Constraints

What the design was not allowed to break

A regulated domain sets the boundaries before the first screen is drawn.

01

Every claim on screen had to be audit-traceable back to its source record.

02

Five frameworks in scope at once: GDPR, ISO 27001, TISAX, NIS2 and the EU AI Act.

03

Three platforms with divergent data models and a shared user base moving between them.

04

An established set of users who could not be asked to relearn the product.

Core insight

It was never a visualisation problem

Every customer call ended the same way: which number do I trust?

The pain was data reconciliation surfacing as UX friction. Three surfaces each computed their own version of the same measure, so the interface was being asked to resolve a disagreement it had no authority to settle. No chart redesign fixes that.

Reconciliation model1 model, 3 lenses
Surfaces 3 platforms Source of truth traceable to Frameworks in scope Privacy InfoSec Compliance consent, requests controls, incidents audits, evidence filtered views One semantic model every number traceable to the record it came from GDPR ISO 27001 TISAX NIS2 EU AI Act five frameworks, one set of numbers

The three platforms keep their own language. What changes is that they now read from the same place, so a figure in Compliance and the same figure in Privacy cannot disagree.

Privacy
Consent records and data subject requests, read through the shared model.
Information Security
Controls and incidents, same records, security framing.
Compliance
Audits and evidence, assembled from the same source rather than re-derived.
Craft

What shipped

The model made the interface possible. These are the pieces that carried it.

01

Monitoring dashboard

Redesigned around the single source of truth.

02

Pattern library

One set of components working across three product contexts.

03

Contracts workflow

Handling regulated documents end to end.

04

Audit motion

Spatial transitions that keep the user oriented inside an audit.

05

Disclosure patterns

Designed with the legal team, not retrofitted past them.

Outcomes

What changed

Reporting time
−45%
days of assembly turned into a view
Organisations
4,000+
on the three platforms
Countries
50+
regulatory contexts served
Support load
Lower
fewer reconciliation tickets

Reporting time fell by 45 percent, and the reconciliation tickets that used to follow every reporting cycle largely stopped arriving. The interface did not get cleverer. It stopped being asked to paper over a disagreement between three databases.

The biggest lever was not the UI. It was the conversation between design and data engineering. A design system is only as trustworthy as the data it renders.

Mahdi FazelProduct Designer · DataGuard

Previous: Tino 24/7 Project 2 of 4
Next project Taxmaro An HR and payroll dashboard for German companies, a domain where a small interface ambiguity becomes a legal problem at the end of the month. See the project

Got three systems that should agree with each other?

Book a call uinermf@gmail.com