Chances are you’ve spotted the blue and white ISS logo on a delivery van on the road, or on the uniform of the cleaning team at your workplace.
ISS provides facility, catering, cleaning and other professional services to corporate clients around the world. It’s one of the largest players in its sector, with entities across Europe, Asia, Australia, and North and South America. GDPR and the careful handling of data are essential here, both to protect the personal data of its own employees and that of its clients.
Yet GDPR today only forms part of the legal puzzle. The impact of new digital legislation such as the AI Act, NIS2 and the Belgian Private Investigation Act is growing fast. A DPO needs to spot these privacy angles but simply cannot be an expert in every single field. To meet these challenges, ISS turned to CRANIUM. Because our DPO works alongside our Digital Law team, ISS gets a unique and efficient overall approach that goes further than what a traditional DPO can offer.
About ISS Facility Services
ISS is an international facility services group headquartered in Copenhagen. It operates in more than 45 countries, with over 325,000 people working under the ISS name.
ISS Facility Services Belgium is part of that group. On a local level, ISS Belgium provides catering, cleaning, technical services and workplace services to organisations in sectors including healthcare, education, pharma and the public sector. ISS takes care of the details so organisations can focus on their core business.
The headquarters in Copenhagen sets out the general framework wherein the legal teams operate, leaving room for local nuance and interpretation per entity. This setup creates a specific challenge, as legislation changes quickly and locally, while the framework itself is set centrally.
The challenge: expertise beyond the DPO alone
The legal team at ISS Belgium consists of four dedicated people, led by Hugo Vanneuville, Legal Director. CRANIUM crossed paths with ISS through the Belgian Private Investigation Act, which requires the appointment of a Data Protection Officer (DPO). Stefan Basiliades, who until then handled data protection responsibilities himself, gained extra support from an external DPO, Bram Goetry.
But with just four people covering such a broad range of tasks, from data protection to IT contracts and digital legislation, there was little room to keep on top of everything internally. That’s why Hugo reached out to CRANIUM’s digital law team.
The approach: a DPO, and a digital law partner
Bram Goetry took on the role of DPO and got up to speed quickly. He became part of the core team and, together with Hugo and Stefan, drew up an annual plan with concrete objectives. ISS was already doing a great deal on data protection, but Bram brought more structure to that approach.
“CRANIUM’s added value lies in its experience and off-the-shelf solutions,” says Hugo. “We can easily draw on collective experience across other sectors, and expertise on various types of legislation, not just GDPR.”
Alongside Bram as DPO, Hugo’s team could also count on CRANIUM’s digital law team, which works daily as a specialised team on legislation and contracts relating to data, cybersecurity, AI and technology. This gave them reinforcement not only on data protection, but also in drafting, reviewing and negotiating contracts and other digital matters.
The collaboration: plug and play
Thanks to the smooth start, Hugo’s team could quickly get to work with CRANIUM’s expertise. “Bram settled into our team very quickly and understood almost immediately how our organisation was structured. From day one, he was already working operationally,” says Stefan.
By organising a monthly DPO day, they regularly discuss priorities and adjust the annual plan. This way of working means they can move quickly and always know what the other is working on. It creates a human synergy and efficiency that no technology or AI can replace.
“Working with CRANIUM is almost ‘plug and play’, I’d say,” Stefan adds.
The results: a structural approach for the legal team
The collaboration quickly delivered some concrete results. On data protection, several steps have already been taken, starting with a GDPR annual plan that sets out clear targets to be met. This ranges from implementing an email policy to reviewing how criminal record extracts are processed.
The digital law team also supports ISS during contract negotiations through a risk-based approach. This allows ISS to reach a solid agreement quickly without slowing the business down. The main risks are covered contractually, while remaining risks are made visible and clear. This means ISS can always make a conscious choice, whether to accept these risks or mitigate them outside the agreement.
CRANIUM also continues to support ISS on the Belgian Private Investigation Act and other digital legislation such as the AI Act and NIS2.
What the future holds
The partnership between ISS and CRANIUM shows how a DPO alone is rarely enough for organisations dealing with multiple pieces of digital legislation. By combining an experienced DPO with a digital law team, ISS’s legal team gained more than just an extra pair of hands, they gained a partner that evolves alongside their legal challenges, from GDPR to the AI Act, NIS2 and the Belgian Private Investigation Act.
Is your organisation facing similar challenges around data protection and digital legislation? Discover what CRANIUM can do for you and get in touch for a no-obligation introduction.
