Scaling GDPR Assessments Across 230+ Applications

When the EU approved the General Data Protection Regulation in April 2016, organizations worldwide faced a two-year runway to meet strict new standards for handling personal data. Dow Jones, with customers and employees across global markets, needed a way to evaluate data management, retention, and information flow policies across its entire operation—including a review of every application that processed personal data.

Alex Zhang, a software engineer on Dow Jones' IT team, took on the task of streamlining that compliance effort. His team administers and customizes the company's SSO, HR, and collaboration tools. Zhang describes his role as writing "glue"—code that connects disparate internal systems. For this project, that meant building a pipeline to collect survey data on every application, synthesize the results, and give the GDPR compliance team immediate access to the information it needed.

Connecting Systems to Collect Data

Zhang first used a CMDB system to aggregate Dow Jones' more than 230 applications and map each one to its owners and users. In parallel, he built an internal survey tool to deliver custom questionnaires—over 650 in total—to the relevant employees for completion.

To let the GDPR team request survey results on demand, Zhang developed an ASP.net web form. Each submission triggered a custom application that queried the survey database and generated a PDF report tailored to the specific application or user requested.

Delivering Reports Through Dropbox

The final piece was distribution. Zhang turned to the Dropbox APIs to get the generated PDFs into the hands of the GDPR team quickly. The solution calls the /create_folder endpoint to create a dedicated Dropbox folder, saves the report via the /upload endpoint, and generates a shareable link with the /create_shared_link_with_settings API call. Within minutes of a request, the GDPR team receives an email with a link to download the report from Dropbox. Bulk requests for complete survey results are prepared within 10 minutes.

The integration delivered a frictionless experience for the compliance team, leaning on infrastructure employees already use daily. Zhang notes, "Everyone at Dow Jones has a Dropbox Business account and knows how to use it. Taking advantage of that helped us get the technical hurdles out of the way and give people fast, direct access to the data they needed."

Automation Removes Human Overhead

For Zhang, automation was the key to keeping the compliance process manageable at scale. "Automating the process allowed us to remove the human element," he says. "The less people have to get involved in managing data, the cleaner that data will be and the more time they'll spend focusing on what they do best."

He also credits the Dropbox API documentation for reducing development friction. "Some APIs make developers jump through hoops, but Dropbox's is simple and well documented and overall a pleasure to work with," Zhang says.

Beyond GDPR Compliance

The system Zhang built is not limited to regulatory reporting. He is already applying it to manage Dow Jones' Code of Conduct survey and expects further use cases to surface. "Dropbox offers a unique solution to something that was antiquated for decades," he explains. "It brings social functionality to storage through sharing, availability and collaboration. That's a really powerful combination."