Practical Privacy with Orla Dormer

GDPR, NIS2, DORA, US state laws and now AI incidents. How do you build one incident management model that keeps up with all of them?

In this episode, Orla Dormer welcomes back her first ever guest, Dave Evans, Group DPO at Ultradome, to talk about centralising incident management across regulations and jurisdictions. Dave explains why his team moved to a user-friendly collection form, why a "four-eye" review is essential, and where AI can help with the analysis without replacing human judgement.

The conversation also covers turning incident data into KPIs, training and dashboards, and...

"Can we just get a quick privacy check before we go live next week?" Getting genuine engagement from the business is one of the most persistent challenges in privacy.

In this episode, Orla Dormer speaks with Delizia Diaz, Senior Privacy Counsel and external consultant to companies including McLaren Automotive and FDJ United, about moving from reactive to proactive privacy. Delizia explains why fear-based messaging and going it alone don't work, how to build allies with the CISO and Chief Data Officer, and why privacy teams need to market themselves as business enablers.

The conversation also covers...

Too many stakeholders treat data privacy as a regulatory checkbox — tick it, forget it, move on.

Orla Dormer talks with Vicky Owens, Data and Digital Senior Counsel at SkyShowtime, about why that mindset fails and how to fix it. Vicky shares why the classic "fines and reputational risk" pitch often doesn't land, and how reframing privacy around return on investment — better data, monetisation, competitive edge — changes the conversation. She also shares a real example: how spotting a spike in incidents among contractors led to a training fix that cut incidents by 45%.

📌 Subscribe for more real-world conversations on privac...

New cybersecurity regulation like NIS2 is landing differently in every EU country — and a single incident can now trigger separate reports under multiple frameworks.

Francisco Matos, Compliance Director at Legora and former Associate General Counsel for Cybersecurity Law at Meta, joins Orla Dormer to explain how his team turned that fragmentation into a proactive regulator engagement strategy: cold outreach, a focused paper that got them invited to present at ENISA in Amsterdam, and lessons on building trust with regulators before you need them.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compl...

Orla Dorner is joined by Monika Tomczak-Górlikowska, Group Head of Privacy, Digital & AI Governance at Prosus, to talk about building an agentic AI governance framework at scale.

They discuss why traditional governance controls aren't enough once anyone in an organisation can build an AI agent, how to shift from one-off assessments to continuous risk monitoring, and why staying close to high-risk teams like HR and finance is critical as adoption accelerates.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

Keeping a processor Record of Processing Activities up to date is one of the least glamorous—but most critical—operational challenges in privacy.

In this episode, Orla Dormer is joined by Adrien Hug-Korda, European Data Protection Board Expert and former Privacy Director at Contentsquare, to discuss how privacy teams can automate processor RoPAs, manage large-scale processing operations, and build compliance processes that continue working as organisations grow.

Adrien shares practical lessons from the digital marketing industry, explains how to avoid creating compliance processes that rely on constant manual effort, discusses handling DSRs in cookie-based envi...

What does practical AI governance actually look like day to day in a high-growth FinTech environment?

In this episode of Practical Privacy, Orla Dormer speaks with Taylor Galusha, Lead Privacy and AI Counsel at Chime, about operationalising AI governance through scalable AI vendor assessments.

Taylor explains why manual reviews are difficult to sustain, how robust playbooks can create consistency, and how AI can support the first draft of vendor assessment reviews when given clear guidance, examples, and logic trees.

This episode explores how privacy and AI governance teams can move...

Most organisations have privacy policies. Far fewer have privacy capabilities that actually scale.

In this episode, Cristina Costache, DPO & CISO at Noventiq, explores one of the most persistent challenges facing privacy teams: transforming compliance from a documentation exercise into an operational capability embedded within the organisation.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

How do you complete privacy documentation across hundreds of teams and more than 1,000 applications without overwhelming the business? In this episode of Practical Privacy, Orla Dormer is joined by Aaron Mendelsohn, Director and Senior Privacy Officer at The LEGO Group, to discuss how his team rebuilt and scaled privacy documentation across a large global organisation.

Aaron explains how they combined privacy technology, risk-based prioritisation, and extensive team enablement to successfully document over 1,000 applications within a 12-month period. He also shares why privacy professionals need to move beyond policy writing and spend more time understanding how product...

In this episode of Practical Privacy, Orla Dormer is joined by Fred Descloux, privacy, security, and governance leader, to discuss how organisations can align engineering, security, privacy, and compliance in fast-moving environments where execution speed is critical. Drawing on his experience in highly regulated industries, Fred shares why traditional compliance approaches often create friction, bottlenecks, and what he describes as "compliance theatre"—generating documentation without meaningfully reducing risk.

Together they explore how to:
• Embed privacy and security directly into engineering workflows
• Move away from compliance as a gatekeeping function
• Focus on outcomes rather than per...

Traditional privacy teams were never designed for agile digital transformation.
In this episode of Practical Privacy, Orla Dormer speaks with Naureen Hussain, Founder of Luminate Advisers and former DPO at Virgin Media, about how privacy leaders can support rapid digital transformation without compromising compliance or creating unacceptable risks.

Naureen shares why adding more privacy resources initially failed, how her team embedded into product and digital workflows, and why adopting a product mindset fundamentally changed the way the privacy function operated. The conversation explores cross-functional collaboration, agile delivery, privacy by design, and the importance...

In Episode 12 of Practical Privacy, Orla Dormer is joined by Ben Westwood, Head of Compliance and DPO at the Motor Insurers’ Bureau, to discuss one of the biggest challenges facing privacy and compliance professionals today: How do you deliver proactive change when reactive work never stops? Ben shares how structured annual planning, maturity assessments, risk registers, and alignment with business objectives have transformed the way his team delivers privacy and compliance outcomes. We discuss:Why every privacy team should have a strategic planHow to balance proactive vs reactive workUsing maturity assessments to prioritise effortConnecting privacy goals to wider bu...

Building a scalable vendor assessment process sounds straightforward—until you’re dealing with 50,000+ vendors across 40+ countries.In this episode, Natalija Bitiukova (Head of Data Protection & Digital Law at Carlsberg) shares how her team tackled this challenge in practice, moving beyond fragmented systems and “paper compliance” to a more operational, scalable approach.We discuss:
The pitfalls of running privacy and security assessments separatelyWhy most vendor assessments fail after the questionnaire stageHow to simplify assessments for real users (not lawyers)The importance of data quality and realistic resourcingChange management in large, decentralized organisationsGetting leadership buy-in by framing...

In this episode of Practical Privacy, Orla Dormer speaks with Vicky Owens, Senior Data Privacy and Compliance Counsel at SkyShowtime, about the challenges of being a global data protection leader.

Vicky shares why a privacy-only mindset often falls short, and how understanding business priorities, aligning with stakeholders, and positioning privacy as an enabler is key to success. A practical conversation on influence, prioritisation, and making privacy work in complex organisations.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align...

What does it take to build a global privacy framework that actually works? In this episode, Marcelo Canha, Global Privacy Director and DPO at Organon, shares his experience designing a privacy program from scratch across 80+ countries — starting with a technically perfect framework that ultimately failed.

The lesson? Complexity doesn’t scale. Marcelo explains how shifting to a simple, practical approach — focused on DPIAs, RoPAs, and real business needs — made the difference, and why buy-in is not just a buzzword, but a strategy. A must-listen for privacy leaders navigating global compliance, limited resources, and the gap between regulation and reality...

What does it really take to become a DPO?

In this episode, Naveed Malik (Group DPO at Informa) shares his journey from a non-traditional background into a senior privacy role — and why technical expertise alone isn’t enough.

From building leadership skills outside of work to learning inside established governance frameworks, this episode explores the practical steps needed to bridge the gap and grow into a DPO role.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align comp...

In this episode of Practical Privacy, Orla Dormer speaks with Roy Kamp, Director at UKG and former DPO at Wayfair and McAfee, about a common challenge in vendor negotiations: customers insisting on Standard Contractual Clauses (SCCs) even when they may not apply.

Roy explains why this happens, why negotiating every SCC request doesn’t scale, and how reframing the discussion around actual data flows rather than contractual positions can reduce friction and improve trust with customers.

The conversation explores practical ways privacy teams can enable sales and legal teams, use transparency to build credibility, and avoid un...

In this episode of Practical Privacy, we explore one of the most common misconceptions in SaaS and AI development: the belief that data can truly be fully anonymized.

Orla Dormer speaks with Noemie Weinbaum – Managing Counsel at UKG, about why organizations should stop assuming their datasets are anonymous and instead treat them as pseudonymized personal data. They discuss why true anonymization is extremely difficult under GDPR standards, how SaaS companies often use the same datasets for both service delivery and AI training, and why this creates real risks around re-identification, compliance, and customer trust.

Noemie also sh...

In this episode of Practical Privacy, Orla Dormer speaks with Avishay Klein, Head of Privacy, AI and Cyber Department at Barnea Jaffa Lande. They discuss why privacy programs often fail at implementation — from unrealistic data retention timelines to top-down governance models that teams cannot operationalise. The conversation explores practical ways to align GDPR and AI governance requirements with real business capabilities, emphasising collaboration, understanding operational constraints, and designing processes that teams can actually implement.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operatio...

How do you make AI Act and GDPR training something people actually pay attention to?
In this episode of Practical Privacy, Orla Dormer speaks with Jared Browne, Fexco Group Head of Privacy & AI Governance, about turning regulatory training into engaging, story-driven experiences. From framing AI Act sessions as a murder mystery to delivering AI literacy as a playful “Overlords of the Rings” narrative, Jared shares how storytelling, humor, and structure dramatically improve attention and retention. 

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through con...

Embedding AI governance across 39 countries is not just a compliance exercise, it’s a change management challenge.

In this episode of Practical Privacy, Orla Dormer speaks with Martin Woodward, Director Global Legal & Global Responsible AI Officer at Randstad, about building a global AI governance program in a decentralized organization.

Martin shares why a centralized, top-down approach led to slow adoption, and how appointing Responsible AI Officers in each market transformed engagement and ownership. He also explains why culture should shape your governance strategy, especially in a human-centric organization. If you're starting or scaling AI go...

In Episode 2 of Practical Privacy, Orla Dormer is joined by Helen Graham (Global Head of Privacy at IVC Evidensia) to unpack one of the biggest challenges privacy teams face today: keeping up with a constant wave of new and evolving data legislation.

Helen shares why compliance can’t be treated as a legal exercise alone, how operational context is critical to assessing real business impact, and why effective privacy programmes depend on cross-functional and cross-border collaboration. 

The conversation also reflects on leadership, buy-in, and the ongoing need for privacy professionals to...

In this first episode of Practical Privacy, Orla Dormer sits down with Dave Evans to unpack a problem many privacy teams recognise instantly: having a ROPA that technically exists, but does not actually help you answer real questions.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/