Privacy in Practice

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Tanvi Mehta Krensel, Partner at Squire Patton Boggs and former lead product privacy lawyer for APAC and emerging markets at TikTok, about applying Australian privacy law within global privacy programs and contracts.
Tanvi explains that the Privacy Act does not distinguish between controller and processor, so every APP entity is subject to the same Privacy Act provisions regardless of how they handle personal information. She discusses recent OAIC guidance that treats contracts as important evidence of control and explains how, without mandatory contract terms like those in GDPR Article 28, bargaining power may influence how control and responsibilities are allocated.

The conversation also covers why a website privacy policy alone does not satisfy APP 5, what OAIC decisions indicate about reasonable security steps, and how OAIC guidance addresses cross-border disclosures. Tanvi also explains why cookie consent mechanisms may not adequately address pixels or the collection of sensitive information and discusses several Australian requirements with no direct GDPR equivalent.


What This Episode Covers:

• How Australia’s federal, state, territory, and health privacy laws interact
  
  
• How Australia treats marketing consent, cookies, pixels, and sensitive information
  
  
• How contracts allocate responsibilities without a controller/processor distinction
  
  
• When a GDPR-style data protection addendum may or may not suit an Australian agreement
  
  
• What reasonable steps mean for security under APP 11
  
  
• How cross-border disclosures work without a statutory SCC framework
  
  
• Why a global privacy policy alone does not satisfy APP 5
  
  
• How Australian Consumer Law affects privacy-related contracts and representations
  
  
• Australian-specific rules concerning automated decision-making, government identifiers, unsolicited information, and anonymity
  
  

Tanvi Mehta Krensel is a Partner in the Sydney office of Squire Patton Boggs, where she practices in the firm's data privacy, cybersecurity, and digital assets practice. Before returning to private practice, she spent nearly two years as the lead product privacy lawyer for APAC and emerging markets at TikTok, advising on product privacy, children's online safety, AI and emerging technologies.

Connect with Tanvi Mehta Krensel here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedInFollow VeraSafe here: LinkedIn

If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [00:00] Australia Isn’t GDPR
  
  

Australian privacy law is principles-based by design, and global teams that default to a GDPR lens may overlook important differences. Those differences include Australia’s automated decision-making requirement, which, from December 10, 2026, will extend to computer programs substantially and directly linked to a decision, and APP 9’s heightened treatment of government identifiers.

• [17:29] Redlining Contracts Without Controller/Processor Roles
  
  

Under the Privacy Act, APP entities are subject to the same Privacy Act provisions regardless of how they handle personal information. Recent OAIC guidance identifies contracts as an important way to determine which party holds control. Without mandatory contractual content like that required by Article 28 of the GDPR, bargaining power may influence how control and responsibilities are allocated. Processors may also have flexibility to negotiate matters such as audit rights and how notification and breach responsibilities are handled. 

• [26:36] Should You Scrap a GDPR DPA for Australia?
  
  

A standalone GDPR DPA imported wholesale into an Australian deal may not be the right vehicle. Liability caps or data-loss exclusions in the main agreement may limit the practical effect of separate privacy protections. Consider addressing privacy as part of the broader commercial negotiation.

• [30:27] APP 11 and Reasonable Security
  
  

APP 11 (security), APP 8 (transfers), and APP 5 (notification) all turn on reasonableness rather than prescribed measures. Published decisions can provide practical indications of the Privacy Commissioner’s approach, including her recent statement on the Qantas breach and, just as valuably, her decisions not to pursue enforcement. Treat them as de facto compliance roadmaps.

• [45:18] Privacy Policies vs. APP 5 Collection Notices
  
  

Australia imposes a double notification requirement: a publicly available privacy policy and a separate APP 5 collection notice given at the point data is collected. Recent OAIC decisions on pixels confirm a website privacy policy alone won’t suffice. Practical solutions include pop-ups, upgraded cookie banners, QR codes in physical spaces, and verbal notices where appropriate.


Episode Resources:

• Tanvi Mehta Krensel on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website
  
  

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Patricia Kosseim, Information and Privacy Commissioner of Ontario, about how Canada’s privacy laws and regulatory authorities operate in practice. Patricia explains the roles of federal, provincial, and territorial privacy commissioners, where their jurisdictions may overlap, and how PIPEDA interacts with provincial privacy laws deemed substantially similar. She also describes how regulators cooperate when investigations or breaches extend across jurisdictions.


The discussion then turns to Ontario’s Personal Health Information Protection Act (PHIPA), including how the law permits certain uses of personal health information for research and health-system purposes when its conditions are satisfied. Patricia discusses recurring gaps between written policies and actual implementation, the evidence regulators may ask organizations to produce, organizational responsibility for inappropriate access, and what can build or weaken credibility during proactive regulatory consultation. 


What This Episode Covers:

• How federal, provincial, and territorial privacy commissioners divide and coordinate jurisdiction.
• How PIPEDA interacts with substantially similar provincial privacy laws.
• How Canadian privacy regulators coordinate cross-jurisdiction investigations and breach responses.
• How PHIPA enables certain health-data uses subject to statutory conditions.
• What regulators may expect organizations to demonstrate through evidence and monitoring.
• How governance affects organizational accountability when inappropriate access occurs.
• What builds credibility when organizations seek proactive regulatory consultation.
  
  

Patricia Kosseim is the Information and Privacy Commissioner of Ontario. Before taking on her current role, she spent more than a decade at the Office of the Privacy Commissioner of Canada as senior general counsel, where her work included national privacy policy, appearances before courts and Parliament, and engagement with regulators internationally. Her earlier experience included private practice advising organizations on responsible data governance and work in health research at the intersection of privacy, ethics, and innovation.


Connect with Patricia Kosseim here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedInFollow VeraSafe here: LinkedIn


If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [00:03:08] Canada’s Federal, Provincial, and Territorial Privacy Structure

Patricia explains that Canada does not have one privacy law or one privacy commissioner. Federal, provincial, and territorial commissioners have their own mandates, with jurisdiction that can sometimes overlap or operate in parallel. She also discusses the long-standing cooperation among Canadian privacy regulators and the role courts have played in reinforcing privacy rights in Canada.

• [00:06:34] PIPEDA and Provincial Privacy Laws
  
  

Patricia explains how PIPEDA applies to commercial activity and how its application changes where a province has privacy legislation deemed substantially similar. She discusses Quebec, Alberta, British Columbia, and Ontario’s distinct position under PHIPA, as well as situations in which organizations may fall under concurrent regulatory jurisdiction.

• [00:19:56] PHIPA, Health Information, and Research
  
  

The discussion turns to Ontario’s health privacy law. Patricia describes PHIPA as an enabling statute that permits specified uses of personal health information, including for research and health-system purposes, subject to conditions. She uses research as an example to discuss research plans, ethics review, agreements, and the importance of maintaining those safeguards as projects change.

• [00:24:05] Demonstrating That Privacy Controls Work in Practice

Patricia identifies recurring gaps between organizational policies and implementation. Examples include missed annual training, PIAs that were required but not completed, inconsistent software patching, available security controls that were not enabled, unimplemented audit recommendations, and information retained beyond intended periods. She explains what  her office may expect organizations to produce as evidence that their stated practices have actually been followed.

• [00:35:18] Building Credibility Through Regulatory Engagement
  
  

Patricia discusses the consultation function of her office and the circumstances in which organizations may approach a regulator proactively. She explains that credibility is strengthened when organizations engage early but have already assessed the privacy implications themselves, including through a PIA. Consultation undertaken largely to demonstrate that the regulator was contacted, without meaningful regard for its recommendations, can have the opposite effect.


Episode Resources:

• Patricia Kosseim here: LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website
  
  

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

Children’s privacy requires more than adapting privacy rules for younger users. Children may not fully understand the consequences of sharing personal information, may lack the legal capacity to consent to certain processing, and can be more susceptible to persuasive design features. At the same time, the age at which someone is legally treated as a child varies across jurisdictions and processing activities. 

Hailun Ying, Head of Privacy and Security, Legal at Roblox, joins Kellie du Preez and Danie Strachan to examine this fragmented legal landscape. The conversation covers COPPA in the U.S., the EU and the UK GDPR, age-appropriate design codes, Brazil’s LGPD and ECA Digital, and South Korea’s PIPA.

They also explore the practical challenges of age assurance, including age verification, age estimation, and self-declaration. Technologies involving government-issued identification, facial age estimation, liveness checks, and other methods may help businesses assess users’ ages, but they can also create risks involving biometrics, vendor security, data retention, demographic bias, and user trust.

Hailun closes with three practical priorities for businesses: understand the user base, make privacy-protective settings the default for young users, and treat children’s privacy as a shared cross-functional responsibility.

What This Episode Covers:

• Why children cannot simply be treated as younger versions of adult users.
  
  
• How children’s privacy laws move beyond notice and consent.
  
  
• Why the legal definition of a child differs across jurisdictions.
  
  
• The distinction between agreeing to use a service and consenting to the processing of personal data.
  
  
• How COPPA, the EU and the UK GDPR, age-appropriate design codes, the LGPD, ECA Digital, and PIPA approach children’s data.
  
  
• The differences between age verification, age estimation, and self-declaration.
  
  
• How facial age estimation and liveness checks work.
  
  
• The COPPA Catch-22 created by collecting information to determine whether a user is a child.
  
  
• What businesses should do after discovering that they have collected personal information from a child under 13 without verifiable parental consent when no relevant exception applies.
  
  
• How biometric laws, vendor security, data retention, and model bias affect age-assurance programs.
  
  
• Why third-party SDKs and advertising networks need to be included in children’s privacy reviews.
  
  
• Why data mapping remains essential to identifying and managing children’s data.
  
  
• How legal, compliance, product and design, engineering, and trust and safety teams need to work together.
  
  

Hailun Ying is the Head of Privacy and Security, Legal at Roblox, where she leads the team responsible for privacy and cybersecurity legal matters across one of the world’s largest online platforms for user-generated content. Her career has focused on data privacy, including previous work at PayPal involving mergers and acquisitions, product development, and security incidents.

Connect with Hailun Ying here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedInFollow VeraSafe here: LinkedInIf you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [03:06] Why Children Are Not Simply Younger Adults
  
  

The traditional notice-and-consent model assumes that users can understand a privacy notice, assess the consequences of sharing information, and make an informed decision. Children may not have that same capacity and can be more vulnerable to persuasive design patterns and harms that may follow them into adulthood. Modern children’s privacy laws are therefore introducing protections that go beyond transparency and consent.

• [05:37] The Global Patchwork of Age Thresholds
  
  

There is no consistent global definition of a child. The relevant threshold may be 12, 13, 14, 16, or 18 depending on the country, state, legal framework, and processing activity involved. Businesses need to understand where their users are located and which requirements apply rather than relying on a single global age cutoff.

• [19:23] Age Verification, Estimation, and Self-Declaration
  
  

Age assurance is an umbrella term covering several ways of determining whether a user falls above or below an age threshold. Verification may involve government identification or payment instruments, while estimation can use facial features, behavioral signals, or emerging hand-scanning technology. Self-declaration asks users to provide their age directly, but each method comes with different levels of accuracy, friction, and privacy risk.

• [24:16] The COPPA Age-Assurance Catch-22
  
  

COPPA may restrict a business from collecting personal information from a child without parental consent. However, determining whether someone is a child can itself require collecting a selfie, an identification document, or date of birth. Hailun explains the FTC’s enforcement approach discussed in the episode and the conditions businesses need to consider when collecting information solely for age-assurance purposes.

• [30:23] Biometrics, Vendor Risk, and Model Bias
  
  

An age-assurance tool may implicate laws beyond children’s privacy law. Businesses may also need to consider biometric privacy requirements, vendor security, retention practices, breach response, model accuracy, and demographic bias. A solution intended to reduce one privacy risk can create another if the technology or vendor is not properly assessed.

• [41:33] Three Priorities for Businesses
  
  

Hailun recommends starting with the information the business already has. Organizations should understand where their users are located, the likely demographics of the user base, and the quality of their age data. Privacy-protective settings should be the default for young users, and responsibility should be shared across legal, product and design, engineering, trust and safety, policy, and compliance teams.


Episode Resources:

• Hailun Ying on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website
  
  

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan, speak with Tom Kemp, Executive Director of the California Privacy Protection Agency (CalPrivacy) about how California is approaching consumer privacy rights in practice. The discussion focuses on what businesses need to understand about opt-out mechanisms, Global Privacy Control (GPC) signals, vendor tools, risk assessments, cybersecurity audits, good faith compliance efforts, and California’s new DROP system for data broker deletion requests. 

Before joining CalPrivacy, Tom Kemp was a Silicon Valley-based technology entrepreneur and the founder and CEO of Centrify, a cybersecurity company focused on access governance and privileged accounts. In the episode, he explains how building and scaling a company, going through GDPR compliance firsthand, and later working in privacy, cybersecurity, and AI policy shaped his view of practical regulation: privacy rights need to be meaningful and accessible for consumers, while businesses need obligations they can operationalize and test in the real world.

What this episode covers:

• What CalPrivacy expects from practical, frictionless consumer rights.
• Common opt-out issues involving cookie banners, “Do Not Sell or Share” links, web forms, and GPC signals.
• Why businesses cannot rely on privacy tools or consent platforms without testing their configuration.
• Why opt-outs should be consumer-focused and identity-focused, not limited to one device, browser, app, or platform.
• How businesses can adapt existing GDPR, DPIAs, PIAs and compliance processes for California risk assessments
• What CalPrivacy expects from risk assessment submissions and why businesses should assume submissions may be reviewed.
• How good-faith compliance efforts, testing, remediation, and regulator engagement may be viewed.
• How California’s DROP system helps Californians request deletion from registered data brokers.
• And so much more!

Tom Kemp is the Executive Director of the California Privacy Protection Agency, also known as CalPrivacy, where he helps lead the state’s work to protect consumer privacy rights under California privacy laws, including the California Consumer Privacy Act, the California Delete Act, and the California Opt Me Out Act. He has a background in cybersecurity entrepreneurship, privacy and AI policy, and public advocacy, and is also the author of Containing Big Tech, which examines online surveillance, tech monopolies, and civil rights in the digital economy.

Connect with Tom Kemp here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedInFollow VeraSafe here: LinkedIn


If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [07:39] Enforcement Priorities: Opt-Outs, Misleading Design, and Data Minimization
  
  

Businesses must honor user choices through interfaces that remain clear and highly accessible. Regulatory actions against major brands like GM, Ford, and Honda prove that California actively pursues companies using dark patterns. Compliance means honoring opt-out signals, avoiding confusing interfaces or dark patterns, and ensuring consumers can exercise their rights in a meaningful, frictionless way.

• [14:50] Why “Out of the Box” Vendor Tools Aren't Enough
  
  

Buying a standard consent management tool does not automatically make your company compliant. If you have not tested your opt-out mechanisms end-to-end from a consumer’s perspective, you may miss broken or incomplete implementations.. Small cookie or pixel misconfigurations can mean a business continues sharing data even after a customer opts out.

• [23:40] Leveraging Existing GDPR Frameworks for California Risk Assessments
  
  

Organizations with mature GDPR data protection impact assessment (DPIA) processes may be well-positioned to approach California risk assessments. However, this is never a simple copy-and-paste exercise. California does not prescribe a single template, and businesses can leverage existing compliance programs, internal infrastructure, and GDPR DPIAs if they supplement them to meet CCPA-specific requirements.

• [37:18] What Good Faith Compliance Looks Like

The agency looks for businesses that are forthcoming, credible, and communicative when working with regulators. Businesses that engage constructively tend to have better outcomes. Testing systems, addressing gaps, correcting misconfigurations, and communicating proactively can build credibility with the agency. Good faith may be considered, but it does not exempt businesses from core legal requirements such as honoring GPC and providing functioning opt-out mechanisms.

• [44:57] The DROP System: Privacy at Scale
  
  

The California DROP system gives Californians a free way to request deletion of their data across multiple registered data brokers. Over 300,000 Californians have signed up, even though deletions do not begin until August by statute. Tom also notes Connecticut's delete-act bill has passed the legislature and awaits the governor's signature, with seven more states considering similar proposals.


Episode Resources:

• Tom Kemp on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website
  
  

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Daniel Solove, Professor of Intellectual Property and Technology Law at George Washington University Law School and CEO of TeachPrivacy. One of the most cited legal scholars in the field of law and technology, Daniel joins the podcast to unpack some of the most common myths that shape how businesses think about privacy—and why those myths can lead to weaker compliance decisions, poor risk assessments, and ineffective privacy strategies.

The conversation explores several assumptions in privacy, including the idea that consumer behaviour proves people do not care about privacy,  that AI presents an entirely new set of privacy problems, and that consent alone is enough to meet a a company's obligations. Daniel explains why  these beliefs often  fall apart under closer scrutiny, and what a more thoughtful, practical, and forward-looking approach to privacy should look like. 

What this episode covers:

• Why the privacy paradox is a risk-calculation, not proof that consumers do not care about privacy
• Why "nothing to hide, nothing to fear" misunderstands what privacy is actually about
• How AI inference may make seemingly ordinary personal data sensitive in practice
• Why consent does not end a company’s privacy obligations 
• Why staying a step ahead of the law is more achievable and more valuable than chasing perfect compliance
• Why security certifications and privacy compliance solve different problems
• Why privacy regulation can redirect innovation and encourage privacy by design 
• And so much more!

Daniel is the author of more than 10 books and one of the most cited legal scholars in the field of law and technology. Beyond academia, he is also the founder of TeachPrivacy, a specialised privacy training company, and co-founder of the Privacy+Security Forum.

If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [05:41] The Privacy Paradox: Why Behaviour Isn't Evidence of What People Value
  
  

When people click "accept" or trade data for convenience, that is a specific risk calculation made in a specific context, not a reflection of their general views on privacy. The problem is that benefits are tangible and immediate while privacy harms are abstract and often unknowable in advance. Businesses that interpret this behaviour as informed agreement are misreading the signal entirely.

• [10:35] "Nothing to Hide, Nothing to Fear" Misunderstands What Privacy Is Actually About
  
  

Privacy has never been primarily about concealing secrets. It is about control over how information is used, the freedom to not have to explain yourself, and context — who knows what, and when. A person with cancer is not hiding their diagnosis; they are deciding who learns it and on what terms. Businesses that dismiss privacy risk through this framework are starting from the wrong question.

• [14:04] AI Isn't a New Privacy Problem — It's an Old One Amplified
  
  

One of the biggest myths about AI is that it introduces entirely new privacy challenges. AI puts existing problems on ‘steroids’ and exposes how badly the notice-and-consent model was already failing. If people cannot make a reasonable risk calculation when they give their data, and that data can later be used to infer sensitive information, privacy law is not doing its job. AI makes that failure impossible to ignore.

• [26:12] The Innovation Myth: Privacy and Growth Are Not at Odds
  
  

The claim that privacy regulation kills innovation is historically unfounded. Car safety regulation did not stop the auto industry, it redirected innovation toward features customers actually valued and bought more of. A seatbelt is as innovative as a faster car. Privacy regulation does the same: it steers companies to innovate in a different direction, not a lesser one.


Episode Resources:

• Daniel Solove on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website
  
  

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Gabe Maldoff, a partner in Goodwin’s Data, Privacy, and Cybersecurity practice, about privacy in mergers and acquisitions. The conversation explores why investment rounds and acquisitions often become forcing factors for privacy maturity, especially for startups and fast-growth companies preparing for their next stage of growth.
The discussion covers what sellers should prepare before due diligence, how privacy representations work in transaction documents, when disclosure is legally required versus strategically useful, and why the way a company explains its privacy posture can matter as much as any underlying issues.

What this episode covers:

• Why investment rounds and acquisitions can drive privacy maturity 
• How uncertainty around data practices creates deal friction
• The difference between required legal disclosures and strategic disclosures
• Why buyers often evaluate security incidents based on the quality of the response 
• Why AI representations and vendor diligence are becoming more important in deals
• How data governance, privacy notices, and recordkeeping can support acquisition readiness
• Three practical steps companies can take today to better position themselves as acquisition-ready

And so much more!

Connect with Gabe Maldoff here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedIn
Follow VeraSafe here: LinkedIn

If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [05:20] The Biggest Privacy Deal Breakers

The issue  is not necessarily the existence of privacy gaps. More problematic is not knowing they exist. Buyers can price risk, but they can’t price uncertainty. Transparency and self-awareness beat perfection every time.

• [20:47] Security Incidents: What to Disclose and How

Many companies will face an incident eventually. What matters most is the quality of the response, including proper investigation, the right advisers, and taking ownership. A big breach handled well raises fewer red flags than a small one handled poorly.

• [34:21] The Most Valuable Privacy Investment You Can Make

Not every company needs a CPO, but every company needs someone who owns privacy. The right person drives milestones, communicates risk to executives, and brings the calm confidence that buyers look for. People are the single most lucrative investment in privacy.

• [46:04] Three Things You Can Do Today to Be Acquisition-Ready

Buyers are not looking for perfection. They are looking for signs of operational maturity, accountability, and trustworthiness. We explore several areas that can have an outsized impact on how companies are evaluated during diligence.


Episode Resources:

• Gabe Maldoff on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this episode of Privacy in Practice, hosts Kellie du Preez and Danie Strachan sit down with Leah Camilla R. Besa-Jimenez, Group Head, Enterprise Risk Management at PLDT, about how she approaches privacy inside one of the largest Southeast Asian telecommunications companies. The discussion focuses on privacy as an operational practice, not only a legal one: using risk matrices to structure decisions, coaching teams to exercise judgment, raising privacy issues early in project conversations, and shifting the company mindset from data ownership to data stewardship. 

In this episode, the conversation centers on how privacy functions inside day-to-day operations. Leah explains that privacy is largely about process: how data is handled, how risks are assessed, and how teams are trained to identify issues before launch. The episode also discusses how leaders must empower privacy teams to make better decisions.


What this episode covers:

• Why privacy work is often operational, not only legal
• How risk is assessed using impact, likelihood, and specific privacy dimensions
• Why teams need to exercise judgment instead of waiting for answers
• Why privacy questions should be addressed early in design and planning
• Why customer data should be treated as something the company stewards, not owns
• And so much more!
  
  

Connect with Leah Camilla R. Besa-Jimenez here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedInFollow VeraSafe here: LinkedIn


If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [00:05:21] Using Risk Matrices to Structure Decisions

Risk assessments are used to guide conversations by assigning scores based on impact and likelihood. This helps teams explain their reasoning and makes discussions more structured and less reactive.

• [00:09:04] Privacy by Design as a Cultural Practice
  
  

Privacy by design is described as a behavior, not just a process. Embedding privacy depends on how teams think, interact, and raise issues during day-to-day work.

• [00:10:59] Breaking Risk Into Specific Dimensions
  
  

Risk is not treated as a single concept. It is broken down into customer impact, compliance impact, potential harm, exercise of rights, and operational cost, allowing for more precise evaluation.

• [00:14:54] Clarifying Roles in Decision-Making
  
  

Privacy teams do not make business decisions. Their role is to outline the risks associated with each option so that the business can make an informed choice.

• [00:19:51] Planning for Exercise of Rights Early
  
  

Teams are expected to consider how customers will exercise their rights as part of the design process, not after implementation.

• [00:22:10] Starting With Conversation, Not Just Assessment
  
  

Rather than relying only on formal reviews, early conversations are used to understand what teams want to build and to identify privacy considerations before requirements are finalized.I 

• [00:24:18] Moving From Fear to Practical Enablement
  
  

Privacy often starts as a response to risk or pressure, but the goal is to integrate it into how the organization operates so it supports decision-making rather than blocking it.

• [00:27:43] Reframing Data as Stewardship
  
  

Customer data is not owned by the company. It is entrusted to the company to process according to what the customer agreed to, which changes how responsibilities are understood.


Episode Resources:

• Leah Camilla R. Besa-Jimenez on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

California continues to set the pace for U.S. privacy enforcement, and 2025 is proving to be a pivotal year. In this episode of Privacy in Practice, hosts Kellie du Preez and Danie Strachan welcome Daniel Goldberg, Partner and Chair of the Data Strategy, Privacy, and Security Group at Frankfurt Kurnit Klein & Selz and 2025 California Privacy Lawyer of the Year, to unpack what’s really happening behind the scenes of CCPA enforcement.

Daniel shares firsthand insights from public and non-public investigations, including trends emerging from actions involving companies like Sephora, DoorDash, and Jam City. The conversation explores what regulators actually prioritize, why misconfigured opt-outs and vendor oversight remain the most common pitfalls, and how the new Delete Act and data broker rules could dramatically shift compliance obligations.


What this episode covers:

• California’s accelerating enforcement landscape under the CCPA and what’s changed in 2025
  
  
• Why most enforcement actions stem from misconfigured consumer rights processes
  
  
• The rising settlement amounts and what being on notice means for businesses
  
  
• Public vs. non-public settlements and what regulators really prioritize
  
  
• Vendor risk exposure, cookie banner failures, and contract deficiencies
  
  
• How to operationalize opt-outs across websites, apps, and connected ecosystems
  
  
• Data broker registration enforcement and what the Delete Act changes in practice
  
  

And so much more!


Connect with Daniel Goldberg here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedInFollow VeraSafe here: LinkedIn


If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [02:58] What’s Changing in California Privacy Enforcement
  
  

California’s privacy regime has moved from abstract compliance talk to sustained, precedent-setting enforcement. What began as a slow, symbolic action after the CCPA’s 2020 rollout has evolved into a coordinated enforcement landscape led by both the California Attorney General and the California Privacy Protection Agency (CPPA). Public cases, such as Sephora, DoorDash, Tilting Point Media, and Jam City only represent part of the picture. Across actions, regulators are signaling consistent priorities, including clear notice, lawful targeted advertising practices, functional opt-outs, and compliant vendor contracts.

• [11:17] How Enforcement Starts
  
  

Regulatory enforcement can begin the same way customers experience your brand: someone identifies a potential issue while browsing your website, reading about your company, or attempting to exercise their privacy rights. Consumer-facing companies are naturally more visible to regulators, since regulators are consumers too, but the biggest trigger is still complaints, especially when an organization advertises privacy rights and then fails to honor those rights due to misconfiguration, slow response, or a broken process. Many cases aren’t about willful neglect. Often, they stem from gaps between what a company thinks the law requires and what regulators expect in practice. And while companies often study post-investigation website changes for guidance, they do not represent a regulator endorsement nor should they be used as a compliance template. The practical move is to think like a regulator.

• [22:36] Why GDPR Compliance is not enough in the U.S. 
  
  

While the GDPR is rooted in human rights, most U.S. state privacy laws are grounded in consumer protection. That philosophical divide shapes everything from compliance strategy to enforcement risk. U.S. laws tend to focus on notice, opt-outs, unfair or deceptive practices, and contractual safeguards. GDPR, by contrast, is structured around broader accountability and rights-based principles. As enforcement expands and legal challenges grow, companies need more than a checklist. An effective privacy strategy requires practical judgment about real-world risk.

• [45:10] The Cross-Device Opt-Out Obligations
  
  

Regulators expect companies to honor opt-outs signals across all your platforms where a user can be reasonably identified. Companies are expected to effectuate an opt-out across connected systems when data links exist or when a user is identifiable within the ecosystem. If systems genuinely don’t connect and it’s not reasonable to link them, the obligation may be narrower. But companies cannot use fragmentation or technical silos as a workaround or excuse for not honoring opt-outs. 

• [53:22] The AI Service Provider Gray Area 
  
  

When an AI vendor uses client data to train its own models, it may no longer qualify as a “service provider” under the CCPA. Danie Strachan draws a direct parallel to the GDPR controller and processor distinction, while Daniel and Kellie discuss why deidentification is the only defensible safe harbor for companies navigating this gray area. 


Episode Resources:

• Daniel Goldberg on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website
  
  

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this episode of Privacy In Practice, hosts Kellie du Preez and Danie Strachan welcome Lisa Sotto, Chair of the Global Privacy and Cybersecurity Practice at Hunton Andrews Kurth, and a Star Performer for Privacy and Data Security (Chambers and Partners), for a detailed, practitioner-level conversation on how cyber incidents actually unfold, from first anomaly detection through board notification and the regulatory long tail that follows.

The discussion traces what Sotto calls “the arc of an incident”: mobilizing the response team under privilege, retaining forensic investigators and extortion negotiators, coordinating with law enforcement agencies, and managing global notification obligations. Kellie raises the practical complexity of locating affected data subjects when address data is unavailable, the cost dynamics of cyber insurance, and why controllers remain responsible for regulatory notification even when the breach originates with a vendor. Danie examines the ethical and legal dimensions of ransomware payment decisions and extends the accountability discussion across the Atlantic to NIS 2's executive liability provisions—noting that several VeraSafe clients were unaware the directive applied to them.

Together, the three  examine the emerging trend of personal executive accountability through the lens of three landmark matters: the criminal conviction of Uber’s chief security officer, the FTC’s individual consent order against Drizly’s CEO, and the SEC’s recently dismissed action against SolarWinds and its CISO. They also explore why boards have evolved from what Lisa describes as  “deer in headlights” to active participants in cyber governance, and what practical steps—from tabletop exercises to vendor diligence to immutable backups—separate organizations that survive a breach from those that do not.


What this episode covers:

• The current nation-state and criminal threat landscape, including SALT Typhoon, the $1.5B Bybit theft, and DPRK imposter IT workers
• How social engineering and agentic AI have rendered traditional phishing detection obsolete
• The "become aware" notification threshold and the strategic case for early regulatory disclosure
• Why one incident response plan with severity levels outperforms multiple plans
• Ransomware payment decisions: sanctions risk, decryptor reliability, and the limits of criminal promises
• NIS2 executive accountability and the CCPA cybersecurity audit requirements
• How law enforcement agencies operate as strategic partners rather than adversaries during active incidents 
• And so much more!

Lisa Sotto is Chair of the Global Privacy and Cybersecurity Practice at Hunton Andrews Kurth. Recognized as one of the National Law Journal's 100 most influential lawyers in America and named a Star Performer for Privacy and Data Security by Chambers and Partners, Lisa brings decades of experience advising governments and Fortune 500 companies on cybersecurity incident response and data protection strategy.

Connect with Lisa Sotto here: LinkedInConnect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedInFollow VeraSafe here: LinkedIn

If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [05:02] How Ransomware Attacks Really Work Today

Cybercrime today is not cinematic; it’s routine, opportunistic, and relentless. Financially motivated attackers target any organization they can access, exploiting technical gaps or human weaknesses through social engineering. Once inside, they quietly explore systems, stage sensitive data for exfiltration, and then apply pressure. These groups evolve, disband, and re-form, but their playbook stays consistent: find a vulnerability, take what’s valuable, and extort.

• [10:27] The First Critical Hours After a Breach

AI has transformed cybersecurity risk by making sophisticated attacks easy to execute and nearly impossible to spot. Perfectly written phishing emails, deepfake voices, and fake videos have erased the old warning signs, shifting the threat from technical weaknesses to human instincts. Urgency, authority, and the desire to be helpful are now the most exploited vulnerabilities. Training still matters, but it’s no longer enough to rely on yesterday’s cues. Organizations must assume deception will look real and build new safeguards to protect people from being manipulated into doing the wrong thing for the right reasons.

• [21:10] Why Cyber Is a Leadership and Board Responsibility

Cybersecurity incidents don’t fail organizations because of technology alone. They fail when teams operate in silos. A breach is an enterprise-wide crisis that requires coordinated action across IT, security, legal, privacy, communications, HR, risk, and audit, with consistent internal and external messaging. Daily alignment is essential. Equally important, involving law enforcement early can materially improve outcomes. These agencies treat companies as victims, share threat intelligence, and help map attacker tactics, while collaboration may later support prosecution through bodies like the US Department of Justice.

• [10:30] The Arc of a Cyber Incident: Mobilising the Response Under Privilege

Lisa walks through the full incident lifecycle: anomaly detection (or the dreaded media call), mobilising the pre-assembled response team through out-of-band communications, retaining forensic investigators under legal privilege, engaging extortion negotiators, coordinating with law enforcement, and navigating cyber and data protection notification obligations across jurisdictions with timelines ranging from 3 hours (Chile) to 72 hours (EU). She describes live threat actors listening on incident response calls and the necessity of forcing cameras on. 

• [31:19] Personal Liability: From the Uber Conviction to the SolarWinds Dismissal

The discussion traces the three landmark cases establishing the trend of individual executive accountability: (1) the criminal conviction of Uber’s CSO for concealing a breach; (2) the FTC’s consent order that followed Drizly’s CEO personally for ten years, requiring him to implement security measures at any company where he holds a leadership role; and (3) the SEC’s action against SolarWinds’ CISO for allegedly misrepresenting security posture, which was recently dismissed. Strachan adds NIS2’s executive accountability provisions and du Preez notes the CCPA cybersecurity audit requirements — critically observing that these apply to companies with revenue as low as $50M, not just billion-dollar enterprises.

• [44:40] Ransomware Negotiations: Sanctions, Reliability, and the Ethics of Payment

This section provides insights into a practitioner’s framework for the ransom payment decision: when payment for a decryptor may be the only alternative to shutting doors, why immutable backups change the calculus, why paying for data deletion rarely works (criminals may not delete, and notification obligations remain regardless), how sanctions screening determines whether payment is legally permissible, and the sobering reality that some decryptors arrive corrupted and some companies are re-extorted after paying.


Episode Resources:

• Lisa Sotto on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this episode of Privacy in Practice, hosts Kellie du Preez and Danie Strachan welcome Charmian Aw, Partner at Hogan Lovells, to examine the growing relevance of the Cross-Border Privacy Rules (CBPR) System in an increasingly global data economy. Learn why organizations such as Cisco, Mastercard, and Alibaba have obtained certification, why the framework is gaining renewed attention among multinational organizations, and how it complements existing transfer mechanisms such as Standard Contractual Clauses (SCCs). The conversation also explores how CBPR certification plays a role in procurement, regulatory cooperation, and the evolution of responsible data processing.


What You'll Learn: 

• Why the CBPR System is gaining momentum globally beyond APEC
• The commercial case for pursuing both PRP and CBPR certification
• How certification actually works
• The competitive advantage hiding in your procurement checklist
• Why AI and healthcare use cases are accelerating CBPR adoption
• How the Global Cross-Border Privacy Enforcement Arrangement (Global CAPE) enables regulators to share information and coordinate cross-border investigations
• Why regulatory recognition matters and how it may evolve as more jurisdictions join
• And so much more!
  
  

Charmian Aw is a leading privacy and cybersecurity advisor with deep knowledge of frontier technologies, including AI, data protection frameworks, and international compliance strategy. In this episode, she shares insights from the recent Global CBPR forum, which she attended alongside VeraSafe, a recognized CBPR Accountability Agent. The discussion offers a practical and engaging look at how regulatory developments translate into real-world operations and commercial outcomes. Together we discuss how organizations can move beyond compliance as a checkbox to use accountability frameworks such as the CBPR and PRP Systems to support trust, scalability, and business value.


Connect with Charmian Aw here: LinkedIn
Connect with Kellie du Preez here: LinkedInConnect with Danie Strachan here: LinkedIn
Follow VeraSafe here: LinkedIn

If you enjoyed this episode, make sure to subscribe, rate, and review it.


Episode Highlights:

• [04:45] Why the CBPR Deserves More Attention

The CBPR is widely underhyped because many organizations still approach it with the wrong mindset, treating it as a nice-to-have rather than a strategic, regulator-backed tool. As data flows across borders faster than regulation can keep up, relying on fragmented, country-by-country compliance is neither scalable nor sustainable. CBPR reframes that conversation by offering a unified, multi-stakeholder framework that is designed to support continuous, compliant data transfers across diverse jurisdictions with visible regulatory participation and endorsement

• [17:40] How Certification Actually Works

To earn CBPR certification, organizations must apply in their home country through an approved accountability agent, an auditor-like partner who evaluates whether your privacy program meets the framework’s principles. The process involves completing a structured assessment, closing identified gaps, and maintaining ongoing compliance through annual renewals. Importantly, certification requires core privacy practices to already be in place and encourages a truly holistic privacy program.

• [23:51] Overlap With ISO, SOC 2, and GDPR

CBPR certification strategically aligns with existing frameworks, such as GDPR, ISO 27001, SOC 2, and the Data Privacy Framework (DPF). Many of the same controls already exist in your privacy and security programs, making CBPR a natural next step rather than a reinvention of the wheel. More importantly, its value isn’t measured by the cost of certification but rather by the trust signal it sends to customers, regulators, and procurement teams. As more organizations add CBPR certification to procurement and vendor risk checklists, failing to adopt it risks becoming a competitive disadvantage. The true ROI lies in regulatory endorsement, market confidence, and being positioned ahead of the compliance curve.

• [28:51] Practical Business Benefits

Organizations relying solely on adequacy decisions or SCCs are betting their compliance on paperwork that few people truly understand or can operationalize. Global CBPR certification flips that dynamic: instead of signing complex, non-negotiable contracts and hoping the business can keep up, it delivers a regulator-endorsed, trusted compliance stamp. By requiring real assessments, cross-functional involvement, and evidence-based governance, Global CBPR transforms data transfer compliance from a legal checkbox into a practical, scalable framework that reduces contract risk, builds customer trust, and future-proofs operations in a fragmented regulatory world.


Episode Resources:

• Charmian Aw on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe Website

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.