Looks like there is a review process in place. And it caught this move in time.
Not quite. This was more of an intervention. In fact the discussions over the past 6 months have largely been focused on figuring out how to actually block the sale and on what grounds. The final decision may even be questionable. Initially the competition authority wanted to intervene and couldn't. The lower house attempted and failed. There was an attempt to move the contract but time didn't allow so the contract was extended for a short period. That kicked off a legal fight where the courts also ruled that despite how bad of an idea this was there wasn't really anything they could do to stop it.
The final deciding factor came from the BTI - who investigates business dealings with critical infrastructure providers. Solvinity wasn't considered one since all they had was a contract to provide services, but it wasn't really until that contract was extended due to the complexity of moving at short notice that someone convinced them they have jurisdiction to investigate, and now they've issued a legal opinion that caused the government to intervene on national security grounds.
There was no real process in this review. It was more of an "oh FAAAARK how can we stop this?" process.
To be clear there is a legal mandate but that is only to maintain the data within the country. The issue of potential foreign ownership didn't really come into the existing law in any clearly defined way.