Practical Privacy with Orla Dormer

Most organisations have privacy policies. Far fewer have privacy capabilities that actually scale. In this episode, Cristina Costache, DPO & CISO at Noventiq , explores one of the most persistent challenges facing privacy teams: transforming compliance from a documentation exercise into an operational capability embedded within the organisation.

How do you complete privacy documentation across hundreds of teams and more than 1,000 applications without overwhelming the business? In this episode of Practical Privacy, Orla Dormer is joined by Aaron Mendelsohn, Director and Senior Privacy Officer at The LEGO Group , to discuss how his team rebuilt and scaled privacy documentation across a large global organisation. Aaron explains how they com...

In this episode of Practical Privacy, Orla Dormer is joined by Fred Descloux, privacy, security, and governance leader, to discuss how organisations can align engineering, security, privacy, and compliance in fast-moving environments where execution speed is critical . Drawing on his experience in highly regulated industries, Fred shares why traditional compliance approaches often create friction,...

Traditional privacy teams were never designed for agile digital transformation. In this episode of Practical Privacy, Orla Dormer speaks with Naureen Hussain, Founder of Luminate Advisers and former DPO at Virgin Media, about how privacy leaders can support rapid digital transformation without compromising compliance or creating unacceptable risks. Naureen shares why adding more privacy resources...

In Episode 12 of Practical Privacy, Orla Dormer is joined by Ben Westwood, Head of Compliance and DPO at the Motor Insurers’ Bureau , to discuss one of the biggest challenges facing privacy and compliance professionals today: How do you deliver proactive change when reactive work never stops? Ben shares how structured annual planning, maturity assessments, risk registers, and alignment with busine...

Building a scalable v endor assessment process sounds straightforward—until you’re dealing with 50,000+ vendors across 40+ countries. In this episode, Natalija Bitiukova (Head of Data Protection & Digital Law at Carlsberg) shares how her team tackled this challenge in practice, moving beyond fragmented systems and “paper compliance” to a more operational, scalable approach. We discuss: The pit...

In this episode of Practical Privacy, Orla Dormer speaks with Vicky Owens, Senior Data Privacy and Compliance Counsel at SkyShowtime, about the challenges of being a global data protection leader. Vicky shares why a privacy-only mindset often falls short, and how understanding business priorities, aligning with stakeholders, and positioning privacy as an enabler is key to success. A practical conv...

What does it take to build a global privacy framework that actually works? In this episode, Marcelo Canha, Global Privacy Director and DPO at Organon, shares his experience designing a privacy program from scratch across 80+ countries — starting with a technically perfect framework that ultimately failed. The lesson? Complexity doesn’t scale. Marcelo explains how shifting to a simple, practical ap...

What does it really take to become a DPO? In this episode, Naveed Malik (Group DPO at Informa) shares his journey from a non-traditional background into a senior privacy role — and why technical expertise alone isn’t enough. From building leadership skills outside of work to learning inside established governance frameworks, this episode explores the practical steps needed to bridge the gap and gr...

In this episode of Practical Privacy, Orla Dormer speaks with Roy Kamp, Director at UKG and former DPO at Wayfair and McAfee, about a common challenge in vendor negotiations: customers insisting on Standard Contractual Clauses (SCCs) even when they may not apply. Roy explains why this happens, why negotiating every SCC request doesn’t scale, and how reframing the discussion around actual data flow...

In this episode of Practical Privacy, we explore one of the most common misconceptions in SaaS and AI development: the belief that data can truly be fully anonymized. Orla Dormer speaks with Noemie Weinbaum – Managing Counsel at UKG, about why organizations should stop assuming their datasets are anonymous and instead treat them as pseudonymized personal data. They discuss why true anonymization i...

In this episode of Practical Privacy, Orla Dormer speaks with Avishay Klein, Head of Privacy, AI and Cyber Department at Barnea Jaffa Lande. They discuss why privacy programs often fail at implementation — from unrealistic data retention timelines to top-down governance models that teams cannot operationalise. The conversation explores practical ways to align GDPR and AI governance requirements wi...

How do you make AI Act and GDPR training something people actually pay attention to? In this episode of Practical Privacy, Orla Dormer speaks with Jared Browne, Fexco Group Head of Privacy & AI Governance, about turning regulatory training into engaging, story-driven experiences. From framing AI Act sessions as a murder mystery to delivering AI literacy as a playful “Overlords of the Rings” na...

Embedding AI governance across 39 countries is not just a compliance exercise, it’s a change management challenge. In this episode of Practical Privacy, Orla Dormer speaks with Martin Woodward, Director Global Legal & Global Responsible AI Officer at Randstad , about building a global AI governance program in a decentralized organization. Martin shares why a centralized, top-down approach led...

In Episode 2 of Practical Privacy, Orla Dormer is joined by Helen Graham (Global Head of Privacy at IVC Evidensia) to unpack one of the biggest challenges privacy teams face today: keeping up with a constant wave of new and evolving data legislation. Helen shares why compliance can’t be treated as a legal exercise alone, how operational context is critical to assessing real business impact, and wh...

In this first episode of Practical Privacy, Orla Dormer sits down with Dave Evans to unpack a problem many privacy teams recognise instantly: having a ROPA that technically exists, but does not actually help you answer real questions.