https://www.trustworks.io/privacy professionals who want to understand how privacy and AI governance work in the real world.

Hosted by Orla Dormer, the series brings together experienced practitioners to discuss common operational challenges, from scaling GDPR programs and answering data questions internally, to navigating AI governance and legacy tooling constraints.

Each episode focuses on practical lessons, honest reflections, and what teams wish they had known earlier. This podcast is designed as a reference for privacy leaders looking to improve how privacy actually operates inside organisations.]]>enBusinessCopyright TrustWorkshttps://d3wo5wojvuv7l.cloudfront.net/t_rss_itunes_square_1400/images.spreaker.com/original/9cad44d41de53c5acf422f80dbb9d594.jpghttps://www.trustworks.io/Thu, 02 Jul 2026 05:57:13 +0000Orla DormerTrustWorksanalytics@trustworks.ioPractical Privacy is a podcast for privacy professionals who want to understand how privacy and AI governance work in the real world. Hosted by Orla Dormer, the series brings together experienced practitioners to discuss common operational...privacy professionals who want to understand how privacy and AI governance work in the real world.

Hosted by Orla Dormer, the series brings together experienced practitioners to discuss common operational challenges, from scaling GDPR programs and answering data questions internally, to navigating AI governance and legacy tooling constraints.

Each episode focuses on practical lessons, honest reflections, and what teams wish they had known earlier. This podcast is designed as a reference for privacy leaders looking to improve how privacy actually operates inside organisations.]]>falseepisodichttps://www.spreaker.com/episode/why-privacy-programmes-fail-to-scale-cristina-costache--72577081
In this episode, Cristina Costache, DPO & CISO at Noventiq, explores one of the most persistent challenges facing privacy teams: transforming compliance from a documentation exercise into an operational capability embedded within the organisation.]]>https://api.spreaker.com/episode/72577081Thu, 02 Jul 2026 05:55:01 +0000Orla DormerMost organisations have privacy policies. Far fewer have privacy capabilities that actually scale. In this episode, Cristina Costache, DPO & CISO at Noventiq, explores one of the most persistent challenges facing privacy teams: transforming...
In this episode, Cristina Costache, DPO & CISO at Noventiq, explores one of the most persistent challenges facing privacy teams: transforming compliance from a documentation exercise into an operational capability embedded within the organisation.]]>481privacy,privacymanagementfalse116fullhttps://www.spreaker.com/episode/scaling-ropa-pias-privacy-documentation-across-1-000-applications-aaron-mendelsohn--72364524Aaron Mendelsohn, Director and Senior Privacy Officer at The LEGO Group, to discuss how his team rebuilt and scaled privacy documentation across a large global organisation.

Aaron explains how they combined privacy technology, risk-based prioritisation, and extensive team enablement to successfully document over 1,000 applications within a 12-month period. He also shares why privacy professionals need to move beyond policy writing and spend more time understanding how product and engineering teams actually work.

This episode covers:
• Scaling ROPAs, PIAs and privacy documentation programmes
• Using risk-based approaches to focus effort where it matters most
• The role of change management in privacy success
• Building stronger relationships with internal stakeholders
• Creating sustainable compliance processes that teams will actually use
• Future opportunities to combine privacy, AI and broader compliance assessments

A practical conversation for privacy leaders, DPOs and compliance professionals looking to improve documentation processes without creating unnecessary friction for the business.]]>https://api.spreaker.com/episode/72364524Tue, 23 Jun 2026 05:50:02 +0000Orla DormerHow do you complete privacy documentation across hundreds of teams and more than 1,000 applications without overwhelming the business? In this episode of Practical Privacy, Orla Dormer is joined by Aaron Mendelsohn, Director and Senior Privacy Officer...Aaron Mendelsohn, Director and Senior Privacy Officer at The LEGO Group, to discuss how his team rebuilt and scaled privacy documentation across a large global organisation.

Aaron explains how they combined privacy technology, risk-based prioritisation, and extensive team enablement to successfully document over 1,000 applications within a 12-month period. He also shares why privacy professionals need to move beyond policy writing and spend more time understanding how product and engineering teams actually work.

This episode covers:
• Scaling ROPAs, PIAs and privacy documentation programmes
• Using risk-based approaches to focus effort where it matters most
• The role of change management in privacy success
• Building stronger relationships with internal stakeholders
• Creating sustainable compliance processes that teams will actually use
• Future opportunities to combine privacy, AI and broader compliance assessments

A practical conversation for privacy leaders, DPOs and compliance professionals looking to improve documentation processes without creating unnecessary friction for the business.]]>646false115fullhttps://www.spreaker.com/episode/enhancing-privacy-security-compliance-without-slowing-business-growth-fred-descloux--72342468 in fast-moving environments where execution speed is critical. Drawing on his experience in highly regulated industries, Fred shares why traditional compliance approaches often create friction, bottlenecks, and what he describes as "compliance theatre"—generating documentation without meaningfully reducing risk.

Together they explore how to:
• Embed privacy and security directly into engineering workflows
• Move away from compliance as a gatekeeping function
• Focus on outcomes rather than perfection
• Build scalable operating models that support growth
• Make privacy and security everyone's responsibility
• Avoid creating bottlenecks while maintaining strong controls
• Prepare for audits through operational excellence rather than audit-driven processes
• Balance business agility with regulatory expectationsA practical conversation for privacy professionals, security leaders, compliance teams, and anyone trying to support innovation without compromising governance.

🎧 Follow Practical Privacy for more real-world lessons from privacy, security, and compliance leaders.]]>https://api.spreaker.com/episode/72342468Thu, 11 Jun 2026 05:15:02 +0000Orla DormerIn this episode of Practical Privacy, Orla Dormer is joined by Fred Descloux, privacy, security, and governance leader, to discuss how organisations can align engineering, security, privacy, and compliance in fast-moving environments where execution... in fast-moving environments where execution speed is critical. Drawing on his experience in highly regulated industries, Fred shares why traditional compliance approaches often create friction, bottlenecks, and what he describes as "compliance theatre"—generating documentation without meaningfully reducing risk.

Together they explore how to:
• Embed privacy and security directly into engineering workflows
• Move away from compliance as a gatekeeping function
• Focus on outcomes rather than perfection
• Build scalable operating models that support growth
• Make privacy and security everyone's responsibility
• Avoid creating bottlenecks while maintaining strong controls
• Prepare for audits through operational excellence rather than audit-driven processes
• Balance business agility with regulatory expectationsA practical conversation for privacy professionals, security leaders, compliance teams, and anyone trying to support innovation without compromising governance.

🎧 Follow Practical Privacy for more real-world lessons from privacy, security, and compliance leaders.]]>752false114fullhttps://www.spreaker.com/episode/how-to-be-a-digital-enabler-without-compromising-compliance-naureen-hussain--72019339In this episode of Practical Privacy, Orla Dormer speaks with Naureen Hussain, Founder of Luminate Advisers and former DPO at Virgin Media, about how privacy leaders can support rapid digital transformation without compromising compliance or creating unacceptable risks.

Naureen shares why adding more privacy resources initially failed, how her team embedded into product and digital workflows, and why adopting a product mindset fundamentally changed the way the privacy function operated. The conversation explores cross-functional collaboration, agile delivery, privacy by design, and the importance of experimentation and user-centric compliance processes.]]>https://api.spreaker.com/episode/72019339Tue, 02 Jun 2026 05:15:02 +0000Orla DormerTraditional privacy teams were never designed for agile digital transformation. In this episode of Practical Privacy, Orla Dormer speaks with Naureen Hussain, Founder of Luminate Advisers and former DPO at Virgin Media, about how privacy leaders can...In this episode of Practical Privacy, Orla Dormer speaks with Naureen Hussain, Founder of Luminate Advisers and former DPO at Virgin Media, about how privacy leaders can support rapid digital transformation without compromising compliance or creating unacceptable risks.

Naureen shares why adding more privacy resources initially failed, how her team embedded into product and digital workflows, and why adopting a product mindset fundamentally changed the way the privacy function operated. The conversation explores cross-functional collaboration, agile delivery, privacy by design, and the importance of experimentation and user-centric compliance processes.]]>577false113fullhttps://www.spreaker.com/episode/how-privacy-teams-can-deliver-proactive-change-ben-westwood--71921402Ben Westwood, Head of Compliance and DPO at the Motor Insurers’ Bureau, to discuss one of the biggest challenges facing privacy and compliance professionals today: How do you deliver proactive change when reactive work never stops? Ben shares how structured annual planning, maturity assessments, risk registers, and alignment with business objectives have transformed the way his team delivers privacy and compliance outcomes. We discuss:

• Why every privacy team should have a strategic plan
• How to balance proactive vs reactive work
• Using maturity assessments to prioritise effort
• Connecting privacy goals to wider business objectives
• Getting executive buy-in for compliance initiatives
• The importance of reviewing and demonstrating progress

A practical conversation packed with actionable ideas for privacy leaders, DPOs, and compliance professionals trying to create meaningful change inside busy organisations.]]>https://api.spreaker.com/episode/71921402Thu, 21 May 2026 06:15:02 +0000Orla DormerIn Episode 12 of Practical Privacy, Orla Dormer is joined by Ben Westwood, Head of Compliance and DPO at the Motor Insurers’ Bureau, to discuss one of the biggest challenges facing privacy and compliance professionals today: How do you deliver...Ben Westwood, Head of Compliance and DPO at the Motor Insurers’ Bureau, to discuss one of the biggest challenges facing privacy and compliance professionals today: How do you deliver proactive change when reactive work never stops? Ben shares how structured annual planning, maturity assessments, risk registers, and alignment with business objectives have transformed the way his team delivers privacy and compliance outcomes. We discuss:

• Why every privacy team should have a strategic plan
• How to balance proactive vs reactive work
• Using maturity assessments to prioritise effort
• Connecting privacy goals to wider business objectives
• Getting executive buy-in for compliance initiatives
• The importance of reviewing and demonstrating progress

A practical conversation packed with actionable ideas for privacy leaders, DPOs, and compliance professionals trying to create meaningful change inside busy organisations.]]>717compliance,dataprotection,dpo,privacyleadership,privacyprofessionals,riskmanagementfalse1fullhttps://www.spreaker.com/episode/building-a-scalable-vendor-assessment-process-gdpr-nis2-natalija-bitiukova--71852478endor assessment process sounds straightforward—until you’re dealing with 50,000+ vendors across 40+ countries.In this episode, Natalija Bitiukova (Head of Data Protection & Digital Law at Carlsberg) shares how her team tackled this challenge in practice, moving beyond fragmented systems and “paper compliance” to a more operational, scalable approach.We discuss:

• The pitfalls of running privacy and security assessments separately
• Why most vendor assessments fail after the questionnaire stage
• How to simplify assessments for real users (not lawyers)
• The importance of data quality and realistic resourcing
• Change management in large, decentralized organisations
• Getting leadership buy-in by framing compliance as a business issue

A practical conversation for anyone working on vendor risk, GDPR, NIS2, or scaling compliance processes.
About the podcast:
Practical Privacy explores how privacy and security teams solve real-world challenges at scale.
Brought to you by TrustWorks https://www.trustworks.io/]]>https://api.spreaker.com/episode/71852478Tue, 12 May 2026 05:45:02 +0000Orla DormerBuilding a scalable vendor assessment process sounds straightforward—until you’re dealing with 50,000+ vendors across 40+ countries.In this episode, Natalija Bitiukova (Head of Data Protection & Digital Law at Carlsberg) shares how her team...endor assessment process sounds straightforward—until you’re dealing with 50,000+ vendors across 40+ countries.In this episode, Natalija Bitiukova (Head of Data Protection & Digital Law at Carlsberg) shares how her team tackled this challenge in practice, moving beyond fragmented systems and “paper compliance” to a more operational, scalable approach.We discuss:

• The pitfalls of running privacy and security assessments separately
• Why most vendor assessments fail after the questionnaire stage
• How to simplify assessments for real users (not lawyers)
• The importance of data quality and realistic resourcing
• Change management in large, decentralized organisations
• Getting leadership buy-in by framing compliance as a business issue

A practical conversation for anyone working on vendor risk, GDPR, NIS2, or scaling compliance processes.
About the podcast:
Practical Privacy explores how privacy and security teams solve real-world challenges at scale.
Brought to you by TrustWorks https://www.trustworks.io/]]>500false111fullhttps://www.spreaker.com/episode/being-a-global-data-protection-leader-why-privacy-alone-isn-t-enough-vicky-owens--71402270
Vicky shares why a privacy-only mindset often falls short, and how understanding business priorities, aligning with stakeholders, and positioning privacy as an enabler is key to success. A practical conversation on influence, prioritisation, and making privacy work in complex organisations.]]>https://api.spreaker.com/episode/71402270Mon, 04 May 2026 09:30:51 +0000Orla DormerIn this episode of Practical Privacy, Orla Dormer speaks with Vicky Owens, Senior Data Privacy and Compliance Counsel at SkyShowtime, about the challenges of being a global data protection leader. Vicky shares why a privacy-only mindset often falls...
Vicky shares why a privacy-only mindset often falls short, and how understanding business priorities, aligning with stakeholders, and positioning privacy as an enabler is key to success. A practical conversation on influence, prioritisation, and making privacy work in complex organisations.]]>276privacy,privacyprofessionalfalse110fullhttps://www.spreaker.com/episode/designing-a-global-privacy-framework-what-actually-works-marcelo-canha--71235360
The lesson? Complexity doesn’t scale. Marcelo explains how shifting to a simple, practical approach — focused on DPIAs, RoPAs, and real business needs — made the difference, and why buy-in is not just a buzzword, but a strategy. A must-listen for privacy leaders navigating global compliance, limited resources, and the gap between regulation and reality.]]>https://api.spreaker.com/episode/71235360Mon, 04 May 2026 09:21:54 +0000Orla DormerWhat does it take to build a global privacy framework that actually works? In this episode, Marcelo Canha, Global Privacy Director and DPO at Organon, shares his experience designing a privacy program from scratch across 80+ countries — starting with...
The lesson? Complexity doesn’t scale. Marcelo explains how shifting to a simple, practical approach — focused on DPIAs, RoPAs, and real business needs — made the difference, and why buy-in is not just a buzzword, but a strategy. A must-listen for privacy leaders navigating global compliance, limited resources, and the gap between regulation and reality.]]>543privacyfalse19fullhttps://www.spreaker.com/episode/how-to-become-a-dpo-without-a-traditional-background-naveed-malik--70897226
In this episode, Naveed Malik (Group DPO at Informa) shares his journey from a non-traditional background into a senior privacy role — and why technical expertise alone isn’t enough.

From building leadership skills outside of work to learning inside established governance frameworks, this episode explores the practical steps needed to bridge the gap and grow into a DPO role.]]>https://api.spreaker.com/episode/70897226Wed, 08 Apr 2026 20:00:02 +0000Orla DormerWhat does it really take to become a DPO? In this episode, Naveed Malik (Group DPO at Informa) shares his journey from a non-traditional background into a senior privacy role — and why technical expertise alone isn’t enough. From building...
In this episode, Naveed Malik (Group DPO at Informa) shares his journey from a non-traditional background into a senior privacy role — and why technical expertise alone isn’t enough.

From building leadership skills outside of work to learning inside established governance frameworks, this episode explores the practical steps needed to bridge the gap and grow into a DPO role.]]>653dpo,privacyfalse18fullhttps://www.spreaker.com/episode/customer-dpas-and-the-overuse-of-sccs-fixing-data-transfer-friction-roy-kamp--70566468
Roy explains why this happens, why negotiating every SCC request doesn’t scale, and how reframing the discussion around actual data flows rather than contractual positions can reduce friction and improve trust with customers.

The conversation explores practical ways privacy teams can enable sales and legal teams, use transparency to build credibility, and avoid unnecessary complexity in customer DPAs.]]>https://api.spreaker.com/episode/70566468Mon, 30 Mar 2026 18:00:02 +0000Orla DormerIn this episode of Practical Privacy, Orla Dormer speaks with Roy Kamp, Director at UKG and former DPO at Wayfair and McAfee, about a common challenge in vendor negotiations: customers insisting on Standard Contractual Clauses (SCCs) even when they...
Roy explains why this happens, why negotiating every SCC request doesn’t scale, and how reframing the discussion around actual data flows rather than contractual positions can reduce friction and improve trust with customers.

The conversation explores practical ways privacy teams can enable sales and legal teams, use transparency to build credibility, and avoid unnecessary complexity in customer DPAs.]]>578aigovernance,privacyfalse17fullhttps://www.spreaker.com/episode/stop-calling-it-anonymous-the-reality-of-pseudonymized-data-in-saas-noemie-weinbaum--70565936
Orla Dormer speaks with Noemie Weinbaum – Managing Counsel at UKG, about why organizations should stop assuming their datasets are anonymous and instead treat them as pseudonymized personal data. They discuss why true anonymization is extremely difficult under GDPR standards, how SaaS companies often use the same datasets for both service delivery and AI training, and why this creates real risks around re-identification, compliance, and customer trust.

Noemie also shares practical advice on building the right governance approach from the start — integrating privacy into the software development lifecycle, involving product and engineering teams early, and creating a cultural shift toward transparent data protection practices. 
]]>https://api.spreaker.com/episode/70565936Wed, 18 Mar 2026 19:10:02 +0000Orla DormerIn this episode of Practical Privacy, we explore one of the most common misconceptions in SaaS and AI development: the belief that data can truly be fully anonymized. Orla Dormer speaks with Noemie Weinbaum – Managing Counsel at UKG, about why...
Orla Dormer speaks with Noemie Weinbaum – Managing Counsel at UKG, about why organizations should stop assuming their datasets are anonymous and instead treat them as pseudonymized personal data. They discuss why true anonymization is extremely difficult under GDPR standards, how SaaS companies often use the same datasets for both service delivery and AI training, and why this creates real risks around re-identification, compliance, and customer trust.

Noemie also shares practical advice on building the right governance approach from the start — integrating privacy into the software development lifecycle, involving product and engineering teams early, and creating a cultural shift toward transparent data protection practices. 
]]>498privacyfalse16fullhttps://www.spreaker.com/episode/why-privacy-programs-fail-at-implementation-avishay-klein--70386126https://api.spreaker.com/episode/70386126Mon, 09 Mar 2026 14:00:03 +0000Orla DormerIn this episode of Practical Privacy, Orla Dormer speaks with Avishay Klein, Head of Privacy, AI and Cyber Department at Barnea Jaffa Lande. They discuss why privacy programs often fail at implementation — from unrealistic data retention timelines to...608privacyfalse15fullhttps://www.spreaker.com/episode/making-privacy-ai-governance-training-actually-engaging-jared-browne--70235951In this episode of Practical Privacy, Orla Dormer speaks with Jared Browne, Fexco Group Head of Privacy & AI Governance, about turning regulatory training into engaging, story-driven experiences. From framing AI Act sessions as a murder mystery to delivering AI literacy as a playful “Overlords of the Rings” narrative, Jared shares how storytelling, humor, and structure dramatically improve attention and retention. ]]>https://api.spreaker.com/episode/70235951Mon, 23 Feb 2026 19:41:07 +0000Orla DormerHow do you make AI Act and GDPR training something people actually pay attention to? In this episode of Practical Privacy, Orla Dormer speaks with Jared Browne, Fexco Group Head of Privacy & AI Governance, about turning regulatory training into...In this episode of Practical Privacy, Orla Dormer speaks with Jared Browne, Fexco Group Head of Privacy & AI Governance, about turning regulatory training into engaging, story-driven experiences. From framing AI Act sessions as a murder mystery to delivering AI literacy as a playful “Overlords of the Rings” narrative, Jared shares how storytelling, humor, and structure dramatically improve attention and retention. ]]>573aigovernnace,privacy,privacytrainingfalse14fullhttps://www.spreaker.com/episode/embedding-ai-governance-across-39-countries-martin-woodward--69547146
In this episode of Practical Privacy, Orla Dormer speaks with Martin Woodward, Director Global Legal & Global Responsible AI Officer at Randstad, about building a global AI governance program in a decentralized organization.

Martin shares why a centralized, top-down approach led to slow adoption, and how appointing Responsible AI Officers in each market transformed engagement and ownership. He also explains why culture should shape your governance strategy, especially in a human-centric organization. If you're starting or scaling AI governance, this episode offers practical lessons on turning principles into action across borders.]]>https://api.spreaker.com/episode/69547146Thu, 12 Feb 2026 11:27:04 +0000Orla DormerEmbedding AI governance across 39 countries is not just a compliance exercise, it’s a change management challenge. In this episode of Practical Privacy, Orla Dormer speaks with Martin Woodward, Director Global Legal & Global Responsible AI...
In this episode of Practical Privacy, Orla Dormer speaks with Martin Woodward, Director Global Legal & Global Responsible AI Officer at Randstad, about building a global AI governance program in a decentralized organization.

Martin shares why a centralized, top-down approach led to slow adoption, and how appointing Responsible AI Officers in each market transformed engagement and ownership. He also explains why culture should shape your governance strategy, especially in a human-centric organization. If you're starting or scaling AI governance, this episode offers practical lessons on turning principles into action across borders.]]>437aigovernance,privacyfalse13fullhttps://www.spreaker.com/episode/why-privacy-can-t-be-solved-by-legal-teams-alone-helen-graham--69547144keeping up with a constant wave of new and evolving data legislation.

Helen shares why compliance can’t be treated as a legal exercise alone, how operational context is critical to assessing real business impact, and why effective privacy programmes depend on cross-functional and cross-border collaboration. 

The conversation also reflects on leadership, buy-in, and the ongoing need for privacy professionals to explain and defend why privacy matters, even after years in the role. A practical discussion for anyone working to make privacy scalable, sustainable, and embedded in the business.]]>https://api.spreaker.com/episode/69547144Thu, 29 Jan 2026 13:54:20 +0000Orla DormerIn Episode 2 of Practical Privacy, Orla Dormer is joined by Helen Graham (Global Head of Privacy at IVC Evidensia) to unpack one of the biggest challenges privacy teams face today: keeping up with a constant wave of new and evolving data legislation....keeping up with a constant wave of new and evolving data legislation.

Helen shares why compliance can’t be treated as a legal exercise alone, how operational context is critical to assessing real business impact, and why effective privacy programmes depend on cross-functional and cross-border collaboration. 

The conversation also reflects on leadership, buy-in, and the ongoing need for privacy professionals to explain and defend why privacy matters, even after years in the role. A practical discussion for anyone working to make privacy scalable, sustainable, and embedded in the business.]]>741dataprotection,privacyfalse12fullhttps://www.spreaker.com/episode/when-ropa-becomes-a-checkbox-and-how-to-fix-it-dave-evans--69547145https://api.spreaker.com/episode/69547145Thu, 22 Jan 2026 15:19:52 +0000Orla DormerIn this first episode of Practical Privacy, Orla Dormer sits down with Dave Evans to unpack a problem many privacy teams recognise instantly: having a ROPA that technically exists, but does not actually help you answer real questions.631false11full