Practical Privacy with Orla Dormer

GDPR, NIS2, DORA, US state laws and now AI incidents. How do you build one incident management model that keeps up with all of them?

In this episode, Orla Dormer welcomes back her first ever guest, Dave Evans, Group DPO at Ultradome, to talk about centralising incident management across regulations and jurisdictions. Dave explains why his team moved to a user-friendly collection form, why a "four-eye" review is essential, and where AI can help with the analysis without replacing human judgement.

The conversation also covers turning incident data into KPIs, training and dashboards, and why rising report volumes can signal a maturing privacy culture.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

"Can we just get a quick privacy check before we go live next week?" Getting genuine engagement from the business is one of the most persistent challenges in privacy.

In this episode, Orla Dormer speaks with Delizia Diaz, Senior Privacy Counsel and external consultant to companies including McLaren Automotive and FDJ United, about moving from reactive to proactive privacy. Delizia explains why fear-based messaging and going it alone don't work, how to build allies with the CISO and Chief Data Officer, and why privacy teams need to market themselves as business enablers.

The conversation also covers aligning privacy maturity with leadership and strategy, and why small teams have to prioritise ruthlessly.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

Too many stakeholders treat data privacy as a regulatory checkbox — tick it, forget it, move on.

Orla Dormer talks with Vicky Owens, Data and Digital Senior Counsel at SkyShowtime, about why that mindset fails and how to fix it. Vicky shares why the classic "fines and reputational risk" pitch often doesn't land, and how reframing privacy around return on investment — better data, monetisation, competitive edge — changes the conversation. She also shares a real example: how spotting a spike in incidents among contractors led to a training fix that cut incidents by 45%.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

New cybersecurity regulation like NIS2 is landing differently in every EU country — and a single incident can now trigger separate reports under multiple frameworks.

Francisco Matos, Compliance Director at Legora and former Associate General Counsel for Cybersecurity Law at Meta, joins Orla Dormer to explain how his team turned that fragmentation into a proactive regulator engagement strategy: cold outreach, a focused paper that got them invited to present at ENISA in Amsterdam, and lessons on building trust with regulators before you need them.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

Orla Dorner is joined by Monika Tomczak-Górlikowska, Group Head of Privacy, Digital & AI Governance at Prosus, to talk about building an agentic AI governance framework at scale.

They discuss why traditional governance controls aren't enough once anyone in an organisation can build an AI agent, how to shift from one-off assessments to continuous risk monitoring, and why staying close to high-risk teams like HR and finance is critical as adoption accelerates.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

Keeping a processor Record of Processing Activities up to date is one of the least glamorous—but most critical—operational challenges in privacy.

In this episode, Orla Dormer is joined by Adrien Hug-Korda, European Data Protection Board Expert and former Privacy Director at Contentsquare, to discuss how privacy teams can automate processor RoPAs, manage large-scale processing operations, and build compliance processes that continue working as organisations grow.

Adrien shares practical lessons from the digital marketing industry, explains how to avoid creating compliance processes that rely on constant manual effort, discusses handling DSRs in cookie-based environments, and offers advice on showing the business value of privacy programmes to leadership.

If you're responsible for privacy operations, governance, or compliance at scale, this episode is full of practical ideas you can apply immediately.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

What does practical AI governance actually look like day to day in a high-growth FinTech environment?

In this episode of Practical Privacy, Orla Dormer speaks with Taylor Galusha, Lead Privacy and AI Counsel at Chime, about operationalising AI governance through scalable AI vendor assessments.

Taylor explains why manual reviews are difficult to sustain, how robust playbooks can create consistency, and how AI can support the first draft of vendor assessment reviews when given clear guidance, examples, and logic trees.

This episode explores how privacy and AI governance teams can move faster, escalate risks more clearly, and build stronger documentation — without removing human judgement from the final decision.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

Most organisations have privacy policies. Far fewer have privacy capabilities that actually scale.

In this episode, Cristina Costache, DPO & CISO at Noventiq, explores one of the most persistent challenges facing privacy teams: transforming compliance from a documentation exercise into an operational capability embedded within the organisation.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

How do you complete privacy documentation across hundreds of teams and more than 1,000 applications without overwhelming the business? In this episode of Practical Privacy, Orla Dormer is joined by Aaron Mendelsohn, Director and Senior Privacy Officer at The LEGO Group, to discuss how his team rebuilt and scaled privacy documentation across a large global organisation.

Aaron explains how they combined privacy technology, risk-based prioritisation, and extensive team enablement to successfully document over 1,000 applications within a 12-month period. He also shares why privacy professionals need to move beyond policy writing and spend more time understanding how product and engineering teams actually work.

This episode covers:
• Scaling ROPAs, PIAs and privacy documentation programmes
• Using risk-based approaches to focus effort where it matters most
• The role of change management in privacy success
• Building stronger relationships with internal stakeholders
• Creating sustainable compliance processes that teams will actually use
• Future opportunities to combine privacy, AI and broader compliance assessments

A practical conversation for privacy leaders, DPOs and compliance professionals looking to improve documentation processes without creating unnecessary friction for the business.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/

In this episode of Practical Privacy, Orla Dormer is joined by Fred Descloux, privacy, security, and governance leader, to discuss how organisations can align engineering, security, privacy, and compliance in fast-moving environments where execution speed is critical. Drawing on his experience in highly regulated industries, Fred shares why traditional compliance approaches often create friction, bottlenecks, and what he describes as "compliance theatre"—generating documentation without meaningfully reducing risk.

Together they explore how to:
• Embed privacy and security directly into engineering workflows
• Move away from compliance as a gatekeeping function
• Focus on outcomes rather than perfection
• Build scalable operating models that support growth
• Make privacy and security everyone's responsibility
• Avoid creating bottlenecks while maintaining strong controls
• Prepare for audits through operational excellence rather than audit-driven processes
• Balance business agility with regulatory expectationsA practical conversation for privacy professionals, security leaders, compliance teams, and anyone trying to support innovation without compromising governance.

🎧 Follow Practical Privacy for more real-world lessons from privacy, security, and compliance leaders.

📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.

🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/