The Privacy Design Lab

The Metrics That Matter: Privacy KPIs That Don't Turn Into Vanity Dashboards 16.04.2026 ↓

Practical metrics for operational readiness (not just pretty charts), and how to translate ops signal into board language.

The Evidence Index: Your Compliance Story Shouldn't Live in Someone's Head 13.04.2026 ↓

Why evidence wins (audits, insurers, customer reviews), and how to efficiently operationalize an artifact register.

Plan Hard, Respond Fast: Is Your Incident Response Plan Lying to You? 09.04.2026 ↓

A practical, non-legal guide to closing the gap between 'we have an IRP' and 'we can execute it at 10:47 p.m.'

Breach Notification: The Timeline Myth that Makes Incidents Worse 06.04.2026 12:37 ↓

A Fieldnotes guide to getting your first 48 hours right without confusing urgency with accuracy.

Special Edition: The security and IP implications of Claude Code’s source leak 02.04.2026 17:33 ↓

A Fieldnotes-style walkthrough of (1) what happened, (2) why it matters from a security standpoint for both Anthropic and enterprise customers, (3) how the IP story gets weird when AI-generated authorship enters the chat, and (4) what the next year could look like for Anthropic after the genie slipped out of the bottle.

Take Your Data Map from Promise to Practice 30.03.2026 16:25 ↓

A practical Fieldnotes guide to creating a “sensible” data map that’s useful under pressure, without turning it into a six‐month art project.

Herding Cats: The Cross‐Functional Domain Your Privacy Program Runs On 17.03.2026 ↓

A practical way to turn “everyone’s involved” into “someone’s actually doing the thing.”

Privacy Change Management: Avoid a Corporate Mutiny by Right-Sizing Your Tooling 12.03.2026 13:56 ↓

Privacy operations that actually ship without a tool spiral.

Vendor Tiering: Your Vendor List Is Not a Vendor Program 11.03.2026 16:35 ↓

A Fieldnotes guide to vendor privacy reviews that actually reduce risk without turning procurement into a bottleneck.

Procurement vs Privacy: The Long-Running Sitcom Where Nobody Laughs 05.03.2026 16:44 ↓

How to operationalize vendor intake and triage so review is predictable, fast, and defensible (without arguments).

Risk Acceptance: Your Product’s Backlog is Not a Risk Committee 04.03.2026 ↓

How to define decision rights, document defensible risk acceptance, and avoid ghostly risks that haunt your backlog graveyard.

Acquisitions: When Two Data Inventories Become One Liability 02.03.2026 ↓

Post-merger privacy integration basics, and how to pick first-90-days priorities so you do not inherit a data attic as a surprise.

When a DSR Request Becomes a Treasure Hunt 26.02.2026 ↓

A Fieldnotes guide to running end‐to‐end data subject rights (DSR) operations without turning your team into a full‐time search party.

You May Be Missing Valuable Privacy Training Opportunities If You're Not Leveraging Tabletops Effectively 26.02.2026 12:02 ↓

A practical, non‐legal guide to weaving tabletop exercises into your privacy training program—plus when to build the muscle in‐house vs. outsource it (so “annual training” isn’t your only line of defense).

The AI Flight Recorder Problem 25.02.2026 11:32 ↓

When logging turns into workplace surveillance

Channeling Your Inner Privacy Engineer 25.02.2026 6:57 ↓

A practical mindset for product teams. Ship fast, collect less, and avoid accidental data chaos!

Your Privacy Notice is a Promise that You May Not Be Keeping 25.02.2026 8:50 ↓

A practical, non-legal guide to keeping your website privacy notice, your cookie banner, and your site behavior telling the same story.

Your Old Data is Not a Family Heirloom 25.02.2026 ↓

It’s not going to end up on Antiques Roadshow with a surprise valuation, so let this be a gentle intervention to move your data retention program from “we should delete” to “we did delete.”

Cookie Banner Theater 24.02.2026 ↓

When the User Clicks "No" but the Cookies Still Fire

When You Contract with a Vendor, You Don’t Just Entrust Them with Your Data 12.02.2026 ↓

You also entrust them with your reputation.

Why We Should Stop (Always) Treating Privacy Tabletop Exercises Like Fire Drills 06.02.2026 ↓

And start treating them like routine training exercises