GDPR compliance is not a periodic exercise — it is a continuous operational discipline
Qala builds data observability infrastructure for organizations operating under GDPR, Swiss nDSG, and UK GDPR. Our platform gives privacy officers and data engineers a continuously current picture of personal data — without manual audits or one-time consultancy projects.
We are a Zurich-based software company, pre-seed stage, backed by our anchor investor network. Our team brings together seven years of GDPR advisory experience with deep metadata graph and NLP engineering from enterprise data infrastructure.
It started with an 11-day DSAR response
In 2022, David Scott Turner was leading a GDPR audit engagement for a mid-sized Swiss e-commerce company when the company received its first Data Subject Access Request. The privacy team spent 11 days manually querying eight separate databases and exporting spreadsheets — two days before the 30-day deadline.
The problem was not the DSAR itself. It was that the company had no single, reliable picture of where personal data actually lived. Their Record of Processing Activities was 14 months stale. The data engineering team had added three new data pipelines since the last audit without notifying the privacy team.
GDPR compliance was being managed as a one-time documentation exercise, not as a continuous operational discipline.
David partnered with Priya Nair — ex-Palantir data engineering, specialized in metadata graph construction — to build a prototype that could ingest Snowflake schema metadata and run automated classification against the GDPR personal data taxonomy.
The prototype classified 94% of personal data fields correctly on a 200-table warehouse in under 90 minutes. The same classification had taken the privacy team three weeks manually.
Qala is now an always-on data observability and compliance platform serving organizations under GDPR, Swiss nDSG, and UK GDPR.
"Make GDPR compliance a continuous operational discipline, not a periodic documentation exercise."
GDPR compliance fails when it is managed as documentation rather than infrastructure. Organizations invest in one-time data mapping projects that produce accurate snapshots — snapshots that begin drifting from reality the moment the next data pipeline is deployed. By the time a DSAR arrives or a breach occurs, the documentation is months stale.
Qala's mission is to close the gap between documentation and operational reality by making personal data classification, policy enforcement, and compliance audit readiness a continuous, automated layer of the data infrastructure — not a periodic project. We believe that organizations operating under GDPR should have a live, always-accurate picture of their personal data estate, and that this is achievable without replacing existing data infrastructure or hiring additional compliance staff.
We measure success not by the size of the compliance report we produce, but by how rarely our customers have to think about their GDPR compliance posture outside of Qala's dashboard.
What we stand for
Pre-seed. Focused on Swiss and DACH enterprise compliance teams.
We are working with a select group of privacy officers and data engineering teams in Switzerland, Germany, and the Netherlands. Our target: organizations with 500–10,000 employees, at least three cloud data sources, and at least one dedicated privacy officer operating under GDPR, UK GDPR, or Swiss nDSG.
We are pre-seed stage and deliberately focused on a narrow initial segment. Broader horizontal compliance platforms exist; Qala is purpose-built for organizations with live cloud data warehouses and the engineering capability to connect them. Our early customers are using Qala to replace manual ROPA maintenance workflows and to reduce DSAR response times from weeks to hours. We plan to expand into additional EU jurisdictions and US state privacy law (CPRA, VCDPA) as the product matures.
our anchor investor network — Swiss Enterprise Software Angel Network
Qala is backed by a Swiss angel investor network specialising in enterprise software and deep-tech companies. Our investors bring experience across GDPR advisory, data infrastructure, and enterprise SaaS, and deep familiarity with the European regulatory environment.
Join organizations building continuous compliance into their data infrastructure
We are in early access, working with privacy officers and data engineering teams who want to replace periodic compliance documentation with a live observability layer.