Enabled separation of country-specific applications, data, and infrastructure from global IT estate to establish data sovereignty and deliver localized cloud hosting for sustainable growth.
Client
An International Law Firm
The client needed to separate country-specific systems from its globally integrated IT footprint to strengthen data sovereignty, improve control of sensitive information, and comply with regional data laws.
Challenge
Integrated Footprint vs. Regional Compliance Needs
This initiative was driven primarily by the need to comply with a specific country’s Personal Information Protection Law (PIPL) and Data Security Law (DSL), enabling the firm to operate independently and securely in the event of regulatory-driven geographic separation.
The client relied on shared platforms across regions. This created operational and compliance risks in the specific country, particularly in jurisdictions with stringent data laws, which included:
- Limited jurisdictional control of sensitive data shared across global infrastructure.
- Inconsistent access management & complicated regulatory compliance
- No proper optimization of cloud services for localized hosting and scalability
- Increased urgency due to emerging data compliance and regulatory requirements
Solution
Two-Phase Separation with Localized Cloud Hosting
Hexaware executed a structured program to achieve data sovereignty while maintaining global efficiency.
Key solution highlights:
- Performed an extensive data compliance and regulatory assessment to validate controls across cloud environments, applications, and data flows
- Analyzed all applications and data repositories to identify Personally Identifiable Information (PII) and determine whether data was stored in compliance with jurisdictional requirements.
- Classified applications into firm-owned data systems versus client-specific data systems, collaborating closely with the General Counsel (OGC) to establish clear data handling and residency rules in alignment with regional laws and firm policies.
- Built a dual-pronged strategy to support security modernization and data center exit planning
- Executed a 2-phased roadmap
- Phase 1: Logical separation of user access controls with strong SSO and RBAC
- Phase 2: Physical segregation of country offices and assets
- Delivered region-specific data separation by implementing localized cloud hosting for country-specific applications, infrastructure, and datasets
- Migrated high-priority workloads from US (Global instance) to the target country-based cloud environments
- Enabled seamless integration with US platforms to maintain workflow continuity
- Established a dedicated domain environment in target country, segregating all relevant users and resources from the US environment.
- Migrated targeted user groups and applications to a separate Exchange server instance in the target country, ensuring email and collaboration tools were compliant and regionally isolated.
- Defined the target-state architecture to support scalable, regulator-approved cloud transformation
Technology Stack utilized in the engagement:
- iManage
- DMS
- SSRS
- Qlik
- Tableau
- Azure Cloud
- COTS applications
Benefits
Strengthening Compliance and Future Readiness
The country separation initiative delivered measurable improvements in compliance, scalability, and operational continuity.
- Data Sovereignty: Country-specific applications and data hosted independently from global systems
- Compliance: Architecture aligned with regional compliance frameworks and local data laws
- Business continuity: Governed integration ensured seamless access with SSO and RBAC
- Scalability: Target-state blueprint supported local country growth and regulatory adaptability
- Future readiness: Separation model can be extended to new countries where there are such data sovereignty and compliance needs
Summary
Hexaware enabled the client to achieve data sovereignty by disentangling applications, data, and infrastructure from global systems. Through localized cloud hosting and a phased separation approach, the solution ensured compliance with regional data protection regulations, prioritized immediate needs in that country, and instituted a scalable architecture to streamline regulatory adherence as the client expands into additional markets.
Looking to strengthen data sovereignty and compliance across regions? Learn more about our Legal, Risk & Compliance Technology Solutions to get started.
