The Data Protection and Privacy Podcast

Aakash Suri joins David Clarke to reveal how privacy can drive business, demystify AI governance, and end tick-box compliance for good.

Guest: Ash Siri, Founder of AS Privacy and AI Solutions Ltd

 1. Privacy as a Strategic Enabler — Not a Blocker

• Ash positions privacy as a business asset, not a compliance burden.
• He communicates legal requirements in plain English and offers practical steps, gaining trust from senior stakeholders.
• By aligning privacy with business goals, he earns top-down buy-in and builds privacy into strategic objectives.

 Insight: Translate law into value. Privacy earns respect when it drives business outcomes.

 2. In-Person Training > Tick-Box E-Learning

• Ash designed live privacy training that replaced generic e-learning.
• Used interactivity, real examples, and group tasks to create engagement and cultural change.
• Everyone from customer service to board members participated.

Insight: Changing behaviour requires human connection, not slide decks.

3. Proactive AI Governance is Missing

• Most companies rush into AI for efficiency but lack governance.
• Ash advises organisations to ask: “Where’s your policy? Who’s accountable?”
• Governance doesn’t have to be complex — just clear, intentional, and privacy-by-design.

Insight: If you're using AI without a policy, you’re gambling with compliance.

 4. Incident Management Requires Calm, Speed, and Process

• Built practical incident response systems — forms, workflows, and clear roles.
• Created a safe culture where teams felt comfortable reporting issues.
• Emphasised speed of execution, not fear.

Insight: Most failures happen in the first 2 hours. Clarity beats chaos.

5. Build Privacy Culture Through Simplicity, Trust, and Visibility

• Ash used SharePoint hubs, quizzes, sweet incentives, and dialogue to make privacy visible and normal.
• Delivered transparency training that related directly to people’s day-to-day jobs.

Insight: Privacy works when people understand how it affects them, not just the business.

You can contact Aakash Suri here

https://www.linkedin.com/in/aakashsuri-thoughtleader/

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

🎙️ Top 5 Insights from the Podcast with  Arletta Gorecka 

Topic: Competition Law, Privacy & the Facebook Case

1. Facebook’s Exploitation = Competition Breach via Privacy Violations

• The German competition authority found Facebook abused its dominant position not through pricing or exclusion but by violating users' privacy.
• Consent was often buried in complex terms; users weren’t truly aware they were agreeing to pervasive data tracking.
   Insight: This case set a precedent for framing GDPR breaches as competition law violations.

2. Excessive Data Collection Can Be Anti-Competitive

• Under Article 102 TFEU, collecting personal data in ways users don’t understand can be seen as an exploitative abuse.
• Even “privacy-enhancing” features like Apple ATT and Google Privacy Sandbox may still mislead or confuse users.
  Point: Quality degradation (privacy loss) can now be treated as harm to consumers — even if there’s no price involved.

3. “Privacy Traps” Are a Growing Concern

• Whether a platform claims to be privacy-friendly or not, users can still be manipulated or exploited.
• Alet introduces the idea of the “privacy trap” — where both pro-privacy and anti-privacy approaches can lead to exploitative practices.
  Key Thought: It’s not just about collecting data — it’s about how and why it’s being collected.

4. EU Law Now Recognises GDPR Breaches in Competition Context

• The CJEU (Court of Justice of the EU) now affirms that GDPR violations can be considered under competition law, but it’s not automatic.
• Collaboration between Data Protection Authorities (DPAs) and Competition Authorities is crucial — though still inconsistent across EU states.
  Takeaway: Legal coordination is improving, but still needs reform (e.g., decentralising enforcement beyond Ireland).

5. Transparency Is the Solution — For Both Consumers & Businesses

• People often don’t read or understand terms, and consent is mostly uninformed.
• Alet recommends practical transparency tools like videos, visual cues, or real-time data usage popups to help users understand what’s happening.
   Advice to businesses: Be clear, simple, and proactive about data use.
   Advice to users: Know that your data = your value, even if you don’t pay with money.

You can contact   Arletta Gorecka Ph.D here

https://www.linkedin.com/in/arletta-gorecka-25110413b/

 Views are personal. Not legal advice. Info based on public sources at time of recording. 

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

In this episode with Stas Levitan, AI Governance Expert & Co-founder @ DeepKeep we dive deep into the wild west of AI security, shadow AI, and the real risks lurking behind your favourite GenAI tools. Stas shares hard-hitting insights on why most companies are blind to their AI usage, and how governance isn’t just about tick-box compliance — it’s about survival.

Here’s what we covered:

• AI Risk Starts Way Before You Deploy It Most think risk begins at runtime. Nope. It starts the moment you grab that model from a repo — and trust me, most are not as “safe” as they look.
• Shadow AI Is Everywhere Employees are quietly using ChatGPT, Gemini, and open-source models — often with good intentions, but zero oversight. Big risk, bigger blind spot.
• Guardrails Aren’t Optional Anymore Enterprise AI needs serious guardrails — not just generic APIs. Think AI-native tools that track, monitor, and enforce behaviour in real time.
• LLMs Don’t Forget… Ever Feed your chatbot personal data, and you might just see it pop up later — possibly in someone else’s output. 
• AI Security ≠ Traditional SecurityFirewalls won’t save you here. This is about controlling model behaviour, not just access and networks. Totally different mindset needed.
• Big AI Providers = Not Enterprise-Ready The default tools don’t cut it. The second you fine-tune a model or use it with your data — you own the risk.
• EU AI Act Isn’t Just Hype — It’s Happening  Risk assessments, monitoring, documentation — this isn’t optional for high-risk sectors. And no, you probably aren't ready yet.
• Step One: Get Visibility You can’t protect what you can’t see. Start by discovering what AI is actually being used in your org — you might be shocked.

It’s a frank and eye-opening conversation that every CIO, CISO, and compliance lead should hear. Tune in — and if you’re using GenAI without a plan, maybe… stop.

Stas Levitan  can be contacted here 

•DeepKeep official website: https://www.deepkeep.ai
•Stas Levitan LinkedIn: https://uk.linkedin.com/in/stas-levitan

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

Emeka Mosanya, CTO of Certifaction, talks to David Clarke about how their Swiss-based e-signature platform ensures total document confidentiality using end-to-end encryption and local processing—ideal for sectors like healthcare and finance.

Top 5 Key Points:

1. Zero Document Access: Certifaction never sees or stores your documents—everything is fully encrypted.
2. Local Processing: All signing happens in your browser or via an on-premise gateway—no cloud exposure.
3. Strict Compliance: Fully aligned with GDPR and Swiss data protection laws; identity is traceable but private.
4. ISO 27001 Certified: Strong security framework with end-to-end encryption and no backdoors.
5. Fast Integration & White Labelling: Simple Docker-based API, designed to embed easily into third-party platforms.

Emeka Mosanya CTO at Certifaction  can be contacted here   https://www.linkedin.com/in/emekamosanya/   [email protected]

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

5 Key Points from the Podcast with  Lorenza Binkel   CEO of  prodify.it


1.Data Protection Challenges: Companies, especially in regulated industries, struggle with secure AI usage due to data leakage risks, prompting many to ban certain AI tools.

2.Prodify's Security Approach: Prodify uses encryption and role-based permissions to control data access, ensuring that sensitive information remains protected within company systems.

3.Compliance and Integration: Prodify supports compliance with GDPR and other regulations by tracking data usage and offering default settings for various regulatory frameworks.

4.Cross-Industry Relevance: While critical in sectors like finance and healthcare, Prodify's solution is adaptable across industries, benefiting teams in areas like sales, law, and creative fields.

5.Implementation Flexibility: Companies can quickly integrate Prodify's basic functions, with more comprehensive solutions available for long-term, secure AI implementation.


Lorenza Binkel   CEO at prodify  can be contacted here   
https://www.linkedin.com/in/lorenza-binkele-17319254/ https://prodify.it/home
https://prodify.it/home

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

5 Key Points from the Podcast with  Leila  Golchehreh from Relyance.ai

1. Legacy Issues and Modern AI-Driven Privacy Solutions:
    
   • Traditional privacy tools are outdated, slow, and inefficient. Reliance AI provides a modern, AI-powered platform that automates key tasks like DSARs, data mapping, and records of processing activities, reducing manual effort and increasing accuracy.
2. AI as Both a Challenge and an Opportunity in Privacy Management:
    
   • AI complicates data privacy but also provides solutions to manage these complexities. Reliance AI uses static code analysis and large language models to predict data processing behaviors and ensure compliance, making privacy management more efficient and scalable.
3. Benefits of Reliance AI Software:
    
   • • Minimal engineering resources needed for implementation. 
     • Fast setup with automation that reduces reliance on manual processes. 
     • Provides continuous monitoring and alerts for data inconsistencies, reducing risks. 
     • Acts as a "co-pilot" for privacy professionals, enhancing capacity and reducing time spent on repetitive tasks.
4. Balancing AI Automation with Human Expertise:
    
   • AI handles repetitive and data-intensive tasks, but human experts are essential for strategic decision-making, such as evaluating alternative data processing methods and negotiating nuanced contracts.
5. Embedding Privacy as a Core Business Function:
    
   • Organizations must go beyond compliance by integrating privacy deeply into all functions. Building cross-functional teams, securing executive buy-in, and leveraging AI like Reliance AI are critical to fostering a privacy-focused culture that builds trust with customers.

Leila  Golchehreh, Co-Founder & Chief Strategy Officer can be contacted here    https://www.linkedin.com/in/leilagolchehreh/

https://www.relyance.ai/company#contact

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

Top 5 Key Points from the Podcast with Rich Kanadjian from Kingston Technology 

1.       Cybersecurity Importance:

• Critical for legal professionals to protect client confidentiality.
• Increased vulnerabilities due to remote work from the pandemic.

2.       Common Vulnerabilities:

• Internal servers need strong intrusion protection.
• Human errors, stolen credentials, and social engineering are major breach causes.

3.       Best Practices:

• Use air-gapped systems to disconnect sensitive data from the internet.
• Employ hardware encrypted drives like Kingston’s IronKey for data security.

4.       Travel Risks:

• Public Wi-Fi at airports, hotels, and coffee shops are hotspots for hacking.
• Carry data on encrypted drives instead of connecting devices to public networks.

5.       Customs and Legal Compliance:

• Customs can image devices, exposing data.
• Use encrypted drives with features like crypto erase to protect sensitive information.

Rich Kanadjian, Global Business Manager – Encrypted Solutions at Kingston Technology can be contacted here:

www.kingston.com / [email protected] / www.linkedin.com/in/richkanadjian/

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

Top 5 Key Points from the Podcast with Dr. Rachel O'Connell  CEO of TrustElevate

1. Overview and Mission of TrustElevate:
   • TrustElevate aims to create a safer internet for children by verifying the ages of users under 16 and confirming parental responsibility. This is crucial for companies to comply with data protection laws regarding children’s data.
2. Methodology for Verification:
   • The verification process uses a zero-knowledge privacy model, where parents provide minimal information (child’s name, DOB, parent’s mobile number) that is checked against hashed, authoritative data sources without storing personal data.
3. Regulatory Environment and Compliance:
   • The importance of regulatory compliance is highlighted, noting that regulations like GDPR have increased scrutiny on how companies process children’s data. TrustElevate’s service helps companies navigate these regulations by verifying user ages and parental relationships.
4. Technological Innovation and Challenges:
   • TrustElevate employs AI and multi-factor authentication to verify details provided by parents. The discussion also touches on the limitations of age estimation technologies and the ongoing challenges posed by criminals using deep fakes and other methods to circumvent age verification measures.
5. Future Vision and Advice for Companies:
   • The conversation envisages a future where TrustElevate’s verification process is integrated into various services (e.g., social media, banking) to ensure children’s safety online. Companies are advised to adopt clear policies and collaborate across teams to meet their duty of care towards young users, emphasizing trust as a market differentiator.

Dr. Rachel O'Connell CEO of TrustElevate can be contacted here https://www.TrustEleavate.com/   [email protected]

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

Top 5 Key Points from the Podcast with Alexander Garcia Tobar, CEO of ValiMail.
Rising Issue of Email Spoofing and AI-Generated Disinformation: Alexander Garcia Tobar discusses the significant increase in email spoofing and fake messages, emphasizing the role of AI in creating realistic disinformation. This technology allows almost anyone to generate credible-looking content, posing serious challenges to discerning truth from falsehood.

Importance of Email Authentication: The core service of ValiMail., email authentication, is highlighted as a crucial countermeasure against the issue of email spoofing. This process ensures that only authorized entities can send emails on behalf of a company or individual, providing a binary, yes-or-no solution to verify email sources.

The Prevalence of Fake Emails: Tobar reveals a startling statistic: 89% of phishing attacks and a significant portion of cyber attacks begin with fake or spoofed emails. He emphasizes the need for widespread implementation of email authentication standards like DMARC to combat this threat.

Challenges in Email Authentication Implementation: Despite the rising adoption of email authentication, Tobar notes that many companies struggle to implement these protocols correctly. Only a small percentage of domains have successfully applied these measures due to the complexity of email systems and the need for expertise in the field.

ValiMail.’s Role and Mission: As the leader in the email authentication space, ValiMail. is actively involved in setting global standards and provides both free and paid services to help companies implement and manage email authentication effectively. Their mission is to enhance trust in email communication, which remains a primary mode of interaction in the digital age.

The podcast provides valuable insights into the challenges and solutions related to email security and the broader implications of AI in creating disinformation. Alexander Garcia Tobar's expertise offers a clear perspective on the importance of email authentication in maintaining digital trust and security.


Alexander Garcia Tobar CEO of ValiMail can be contacted here https://www.valimail.com/   [email protected]

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme

Dott. Chiara Rustici discusses the  Data Governance Act, Open Data Directive, Digital Markets Act, Digital Services Act how they fit together and look at applicable and upcoming data regulation in the EU and tries and draw some conclusions on what that means for business /revenue models and operating models of data-rich businesses.

Dott. Chiara Rustici is a legal analyst and IT law expert with a focus on the new Brussels-Washington digital regulation drive. She is an independent legal scholar affiliated with the Department of Information Engineering, Electronics and Telecommunications (DIET) of La Sapienza University, in Rome. She was elected Chair of the Law Specialist Group at the BCS, formerly known as British Computing Society and ranked among the top 20 GDPR experts by the GDPR institute, a Swiss membership body for professional data protection practitioners. She is a soight after conference speaker and is widely quoted and published on both sides of the Atlantic. She runs her consultancy and research activities between London, Rome and the Italian Alps.

Dott. Chiara Rustici  can be contacted via Linkedin here

https://www.linkedin.com/in/chiararustici/

The latest in Data Protection and Privacy Podcast by David Clarke
Follow me on Twitter @1davidclarke 96.1k Followers
Join Linkedin GDPR Group 33,475 Others Members for FREE
CoAuthor of an ICO certified GDPR scheme