Privacy in Practice

What if you could build a more effective privacy program by bridging the gap between legal requirements and technical implementation? In this episode of Privacy in Practice, we sit down with Peter Jaffe, VP & Sr. Associate General Counsel for Privacy, Technology, Facilities & Operations at National Geographic Society.


Together, we:

- Explore Peter's unique journey into privacy law
- Examine the critical intersection of technical knowledge and privacy law
- Discuss essential technical concepts for privacy professionals
- Delve into effective strategies for building privacy programs
- Consider the role of privacy professionals as translators between stakeholders
- Explore practical approaches to privacy training
- Share valuable insights on managing global privacy compliance
- And so much more!

With over a decade of experience spanning both private practice and in-house roles, Peter brings a unique blend of technical acumen and legal expertise to privacy law, having evolved from his early career in financial services litigation to becoming a respected voice in privacy and data protection. His approach combines rigorous technical understanding with human-centered privacy principles, making him particularly effective at bridging the gap between legal requirements and practical implementation. Peter's experience in building privacy programs, managing data breaches, and navigating complex regulatory landscapes, coupled with his ability to translate technical concepts for diverse stakeholders, provides valuable insights for privacy professionals at all levels. His emphasis on understanding both the technical architecture and human elements of privacy makes him an especially relevant voice for organizations working to build sustainable privacy programs.

Episode Highlights:

[05:27] Technical Foundation for Privacy Professionals
Peter emphasizes that privacy professionals need a basic understanding of technical concepts to be effective advisors. He recommends learning fundamentals of object-oriented programming, database structures, and access controls - even if informally through self-study. This technical knowledge helps professionals spot nuances that impact transparency requirements and data-handling practices. For privacy leaders developing their skills, starting with introductory programming concepts and database fundamentals provides a crucial foundation for understanding modern privacy challenges. Most importantly, this technical literacy enables better communication with IT teams and more practical implementation guidance.

[11:36] Strategic Approach to Delivering Difficult Privacy News
When delivering challenging privacy-related messages, Peter advocates for a methodical, analytical approach rather than emotional reactions. He recommends first identifying applicable laws and requirements, then systematically exploring options for compliance, and finally presenting a clear risk analysis across liability, litigation, and reputational dimensions. This structured approach helps maintain professional relationships while ensuring stakeholders understand the full context of privacy decisions. Privacy professionals can use this framework to transform potentially confrontational situations into collaborative problem-solving opportunities. The method also helps build credibility and trust with business partners who may be skeptical of privacy requirements.

[18:40] Building Effective Privacy Programs: The "Why" Before "How"
Peter stresses the importance of establishing the foundational "why" of privacy programs before diving into implementation. Privacy leaders should help organizations understand both risk factors (regulatory, litigation, reputation) and positive motivators (customer trust, contractual obligations). This foundation requires a deep understanding of organizational culture, risk tolerance, and stakeholder expectations. The approach should align with existing governance structures rather than imposing a one-size-fits-all solution. Most critically, success depends on finding internal allies with relevant technical skills who can help discover and manage privacy requirements effectively.

[30:35] Targeted Privacy Training Strategy
Rather than attempting to cover all privacy principles broadly, Peter recommends separating training content based on audience needs. For general staff, focus on helping them recognize personal information and understand when to ask for help rather than technical compliance details. This targeted approach improves retention and practical application of privacy concepts. Training should be customized to reflect the organization's specific context and use cases rather than relying solely on generic materials. The key measure of success is whether employees know how to identify privacy issues and engage appropriate resources when needed.

Episode Resources:

• Peter Jaffe on LinkedIn
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn
• VeraSafe on LinkedIn

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

In this inaugural episode of Privacy in Practice, hosts Kellie du Preez and Danie Strachan introduce VeraSafe's new podcast focused on making privacy compliance practical and accessible. Together, they:

• Share their personal journeys into privacy law
• Explore why privacy compliance is both challenging and rewarding
• Discuss the importance of balancing theoretical compliance requirements with real-world business constraints
• Examine recent EDPB guidance on controller obligations 
• Address the growing regulatory emphasis on understanding technical implementations and data flows
• Examine the latest challenges with the EU AI Act
• Emphasize the need for a holistic approach to privacy compliance
• And so much more!

Kellie du Preez is a privacy compliance leader and former litigation attorney who transitioned from defending banks in Boston to focusing on global privacy compliance. With experience as both an IP litigator and privacy professional, she brings a unique perspective on balancing practical business needs with regulatory requirements. As a Data Protection Officer and privacy consultant at VeraSafe, Kellie helps organizations navigate complex privacy challenges with a focus on creating workable, cost-effective solutions.
Danie Strachan is a privacy professional who began his career in South African legal practice, where he developed deep experience in data protection law during the implementation of South Africa's Protection of Personal Information Act (POPIA). As a senior privacy counsel at VeraSafe, he specializes in helping organizations understand and implement privacy requirements across multiple jurisdictions, including the EU. Danie brings valuable insight into the evolution of privacy regulations and practical approaches to compliance.
Episode Highlights:
[00:20:58] Understanding Your Data Processing Chain - Privacy professionals must take a more active role in understanding their complete data processing ecosystem. Recent EDPB guidance emphasizes that organizations can't simply delegate responsibility to processors - they need detailed knowledge of all subprocessors and their security measures. This includes knowing where data is hosted, what security measures are in place, and maintaining proper documentation of the entire processing chain. For DPOs and privacy leads, this means implementing robust vendor management processes, maintaining detailed data maps, and regularly reviewing subprocessor arrangements. This increased oversight requirement may require updating data processing agreements and implementing new monitoring systems.
[00:36:28] Beyond Checkbox Compliance -Privacy compliance requires moving beyond surface-level documentation to meaningful implementation. Organizations often focus too heavily on having privacy notices and policies while neglecting the actual operational aspects of privacy compliance. Privacy professionals need to dive deep into understanding actual data flows, processing activities, and technical implementations. This includes regular audits of data collection practices, storage durations, and processing purposes. The key is connecting written policies to practical implementation through technical controls and operational procedures.
[00:42:28] Preparing for the EU AI Act - With the February 2025 deadline here for prohibited AI systems, privacy professionals need to conduct comprehensive AI audits within their organizations. This includes identifying all AI systems in use, evaluating them against the EU AI Act's risk categories, and developing plans to address any systems that are prohibited. Privacy teams should focus particularly on workplace monitoring systems, automated decision-making tools, and any AI systems that could affect individual rights. Creating an AI inventory and risk assessment framework should be an immediate priority.
[00:47:51] Managing Vendor AI Implementation -Privacy professionals must establish processes to evaluate AI capabilities being introduced through existing vendor relationships. Many vendors are rolling out AI features without explicit notification, creating compliance risks. Privacy teams should implement specific AI review procedures as part of vendor management, require vendors to provide detailed information about AI features, and establish clear internal protocols for when teams need to involve privacy review of new AI capabilities. This requires ongoing communication with business units and regular vendor technology reviews.
Episode Resources:

• VeraSafe Website
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.

Privacy in Practice, brought to you by VeraSafe, is the podcast for actionable insights and real-world strategies for privacy and compliance teams. Hosted by privacy pros Kellie du Preez and Danie Strachan, each episode unpacks the practical side of compliance and data management, bringing together industry leaders and thought-provoking discussions.

In every episode, listeners will discover actionable solutions for today's most pressing privacy challenges. From navigating privacy laws like the GDPR and U.S. state regulations to exploring the intersection of privacy with AI, cybersecurity, and emerging technologies, we cover the topics that matter most to modern privacy professionals. Our discussions feature insights from professionals to help you develop and support privacy programs that drive business growth rather than hinder it.

Whether you’re leading privacy efforts at your company or just beginning to explore this field, tune in for meaningful conversations that provide a straightforward approach to data privacy and empower listeners to make informed, confident decisions. Privacy isn’t just about regulatory boxes—it’s about fostering trust and resilience in a digital world.

Key Links

• VeraSafe Website
• Kellie du Preez on LinkedIn
• Danie Strachan on LinkedIn

Privacy in Practice is handcrafted by our friends over at: fame.so.

Connect with us at [email protected]

This podcast is brought to you by VeraSafe.