project · 2022 · Senior Software Engineer · EPAM Systems
GDPR Compliance Platform for Global Financial Services
A full-stack microservices platform built over 4 years for a multinational financial institution, delivering GDPR compliance with PCI and PII data protection, NLP-based entity extraction, and distributed team delivery across a Scaled Agile framework.
GDPR compliance in a multinational financial institution is not a checkbox. It touches every system that processes personal data, requires legal alignment across jurisdictions, and demands that engineering decisions account for PCI and PII requirements from the first line of code. This project was a four-year engagement building that platform from its foundations, working as a full-stack engineer through initial architecture, iterative delivery, and production operation across teams distributed globally.
System architecture
┌─────────────────────────────────────────────────────────┐│ Angular Frontend ││ (compliance workflows, user interfaces) │└───────────────────────┬─────────────────────────────────┘ │ REST API ▼┌─────────────────────────────────────────────────────────┐│ Spring Boot Microservices ││ ││ Data Subject Rights · Consent Management ││ Entity Extraction · Audit and Reporting ││ PII Classification · Notification Services │└───────┬────────────────────────────┬────────────────────┘ │ │ ▼ ▼┌──────────────────┐ ┌─────────────────────────┐│ Relational DB │ │ Document Store ││ PostgreSQL / │ │ MongoDB ││ Oracle │ │ (unstructured data) │└──────────────────┘ └─────────────────────────┘ │ ▼┌─────────────────────────────────────────────────────────┐│ NLP Extraction Pipeline ││ Stanford NLP · Apache OpenNLP ││ (entity extraction from PDFs and images) │└─────────────────────────────────────────────────────────┘ │ ▼┌─────────────────────────────────────────────────────────┐│ CI/CD and Cloud Deployment ││ Jenkins Pipeline · Pivotal Cloud Foundry │└─────────────────────────────────────────────────────────┘GDPR engineering at scale
The platform was built to meet EU data protection law inside a financial services environment where data volume, cross-border data flows, and regulatory scrutiny are all operating at scale. The core engineering challenge was translating legal obligations (data subject rights, consent management, breach notification, retention policies) into reliable, maintainable software that could evolve as regulations were clarified and as the business grew.
Database design took PCI and PII compliance as hard constraints from the start, not as an afterthought. Schema decisions, data access patterns, and retention logic were all shaped by what the regulation required, not just what was technically convenient.
NLP entity extraction
A significant part of the platform’s intake pipeline involves processing PDFs and scanned images to identify and classify personal data. NLP models built on Stanford NLP and Apache OpenNLP extract named entities from unstructured documents, flagging PII for classification and enabling automated data discovery across document repositories that would be impractical to review manually.
Full-stack delivery
The frontend was built in Angular, providing compliance workflows for data subject access requests, consent management, and audit reporting. The backend follows a microservices architecture with Spring Boot and Spring Data, exposing REST APIs designed for high scalability and maintainability. Multiple databases serve different needs: PostgreSQL and Oracle for structured relational data, MongoDB for flexible document storage.
Delivery and process
The project ran on a Scaled Agile (SAFe) framework across globally distributed teams. Responsibilities covered the full delivery lifecycle: requirement gathering from clients, architecture and database design, iterative development, testing across multiple cycles, and CI/CD pipeline management via Jenkins with deployment to Pivotal Cloud Foundry. Four years of continuous delivery on a regulated platform built habits around code quality, design principles, and the discipline that production financial software demands.