Accountability

9 Jan 2026 · 4 min read

Avoid the ivory tower: Hub-and-Spoke AI governance without exhausting your local colleagues

AI governance is about to be stress-tested by agentic systems, and the companies that hold up won’t be the most centralised, they’ll be the ones that embed oversight locally without burning out their champions.

6 Jan 2026 · 5 min read

15 posts into “Beyond Legal”: what's been covered so far

Fifteen posts in, Beyond Legal has explored why effective data protection (and AI governance) is less about legal interpretation and more about building real organisational capability across risk, engineering, operations, governance, communication, and measurement.

12 Dec 2025 · 9 min read

The messy reality of data protection risk

This post introduces a work-in-progress Causal Loop Diagram, evolving from my earlier "ripple effects" model, that uses the QSEM tool to visualise the messy, interconnected reality of systemic data protection risks and feedback loops.

8 Dec 2025 · 6 min read

Beyond Legal #14: Does your RoPA really show how your company processes personal data? (Why you need business analysis skills)

Your Record of Processing Activities (RoPA) is a solid foundation. Now, let’s bring it to life by swapping legal questions for operational essentials.

10 Nov 2025 · 4 min read

From issues to action: a playful, practical workshop for Data Protection Day 2026

When a financial services Data Protection Leader needs to unite 37 entities across multiple countries for a critical 2026 planning session, we're including some elements of play.

5 Nov 2025 · 14 min read

Beyond legal #12: From headless chickens to coordinated data breach response - why operations beat legal theatre

In this twelfth post of my "beyond legal" series, I'm addressing what many data protection professionals dread: that call you get after you've just finished your third glass on a Friday night. Some breach response plans look impressive in binders gathering dust, but fall apart the moment someone accidentally shares a database containing millions of customer records, or when ransomware locks down your production systems at 2am on a Saturday morning.

26 Oct 2025 · 9 min read

Beyond legal #11: Stop counting activities and start measuring outcomes

In this eleventh post of my "beyond legal" series, I'm addressing perhaps the most forgotten about competency in data protection leadership: the ability to measure what actually matters. Many data protection functions are stuck in a rear-view mirror mindset, counting compliance activities instead of driving forward-looking performance that demonstrates real business value.

3 Sep 2025 · 8 min read

Beyond legal #6 : The great governance misunderstanding

The failure to differentiate between governance and management is not an academic debate. It is the root cause of companies finding themselves in crises, asking themselves "How on earth did we end up here?"

26 Aug 2025 · 8 min read

Beyond legal #4: time to up your risk game

To be effective and gain strategic influence, data protection leaders must move beyond the vague 'privacy risk' definition and learn to articulate data protection failures in the language and currency of the business.

22 Aug 2025 · 8 min read

Beyond legal #3: Why data protection leadership is more complex than just 'difficult' laws, and what it takes to succeed

Distinguishing between difficulty and complexity is crucial. Learn how a multi-disciplinary approach, beyond legal expertise, is essential to establish and run an effective data protection function or office.

13 Aug 2025 · 7 min read

Beyond legal #1: The data protection leader's journey begins

This first post introduces the critical non-legal skills, such as business analysis and stakeholder management, that a Data Protection Leader must master to embed data protection into a global company’s operations.

11 Aug 2025 · 3 min read

Simplify the GDPR? Upgrade your competences instead

The perceived complexity of GDPR and other data protection laws is often a result of a lack of competent leadership and multidisciplinary teams, rather than the laws themselves, emphasising the need for a broader skill set beyond legal knowledge for successful implementation.

10 Apr 2025 · 7 min read

Washing away responsibility? BigTech's data centres and the growing water crisis

We look at how significant and potentially unsustainable water consumption of BigTech data centres, as highlighted in a recent article in The Guardian, poses a direct threat to their publicly stated ESG goals, particularly their environmental and social commitments, and risks accusations of greenwashing, social washing, and overall ESG washing.

17 Mar 2025 · 4 min read

Are ESG leaders using PESTEL to navigate political crosswinds, or are they flying blind?

ESG leaders must adapt to shifting political landscapes by conducting regular analysis and align data protection with evolving ESG requirements to maintain integrity, compliance, and stakeholder trust, or risk their programs becoming dangerously misaligned with regulatory realities.

10 Mar 2025 · 5 min read

AI risks, compliance & leadership: why younger mentors are key

By tapping into the expertise of younger employees, companies can build a more AI-literate leadership team that helps future-proof their companies.