Privacy Governance
Privacy compliance is more than having a privacy policy.
Organisations need practical processes for understanding what personal information they hold, why they collect it, where it goes, who has access to it and how privacy risks are identified and managed throughout the information lifecycle.
I can help organisations develop, review and strengthen privacy governance across areas including:
privacy governance frameworks
privacy policies, standards and procedures
privacy impact assessments
personal information discovery and mapping
collection and consent practices
privacy notices and collection statements
data minimisation
privacy by design
retention and disposal
third-party and vendor privacy risk
privacy incident management
privacy risk and control assessments
privacy awareness and education.
The focus is on moving privacy from documentation and compliance obligations into everyday business practices.
Privacy & Data Governance
Practical governance for the information your organisation relies on
Good governance starts with understanding your data. Organisations collect, use, share and retain increasing volumes of information across systems, business processes, vendors and technology platforms. Without clear ownership, appropriate controls and an understanding of where information is held, managing privacy, regulatory and operational risk becomes increasingly difficult.
I help organisations establish practical privacy and data governance that improves visibility, accountability and control over information. Whether you need to strengthen an existing privacy program, understand how personal information moves through your organisation, establish clearer data governance or address a specific regulatory or operational issue, I can help turn governance requirements into processes that work in practice.
Data Governance
Data is increasingly central to operational decisions, analytics, digital services and artificial intelligence.
But organisations cannot use data confidently if they do not understand what they have, who is responsible for it or whether it can be trusted.
I help organisations establish practical data governance that clarifies ownership, improves accountability and supports more responsible use of information.
This can include:
data governance frameworks
data ownership and stewardship
roles and responsibilities
data classification
data inventories and mapping
data quality governance
data lifecycle management
retention and disposal
governance standards and procedures
governance operating models
reporting and oversight.
The objective is not governance for its own sake. It is to create enough structure around data that people can understand it, manage it and use it appropriately.
Understand where your information actually goes
One of the most common governance challenges is a lack of visibility. Information can move between forms, applications, databases, spreadsheets, integrations, reporting environments, cloud platforms and third-party providers. Over time, it becomes increasingly difficult to answer seemingly simple questions:
What information do we hold?
Why are we collecting it?
Where is it stored?
Who can access it?
Who are we sharing it with?
How long are we keeping it?
Who is responsible for it?
Data discovery and information mapping can provide the foundation for answering these questions and identifying unnecessary collection, duplication, inappropriate access, uncontrolled information flows and other governance risks.
Privacy and Data Governance should work together
Privacy and data governance are often managed separately, but operationally they are closely connected. Privacy depends on understanding data. You cannot effectively manage personal information if you do not know where it is held, how it moves through the organisation, who owns it or how long it is retained.
Similarly, good data governance needs to recognise that some information carries additional privacy, regulatory or ethical obligations.
Bringing these disciplines together can create clearer accountability and reduce duplicated governance processes.
Privacy and Data Governance in an AI environment
Privacy and data governance are also becoming increasingly important as organisations adopt AI. AI systems rely on data.
Before an organisation can confidently govern AI, it needs to understand the information being provided to AI systems, whether that information is appropriate for the intended purpose, how it is being processed and what happens to it afterwards.
This creates important questions around personal information, data quality, data provenance, access, retention, third-party processing and accountability.
Strong privacy and data governance therefore provide an important foundation for responsible AI adoption.
Governance that fits the organisation
Governance should reflect your organisation's size, complexity, regulatory environment and risk profile. A governance framework that looks impressive on paper but cannot be operated by the people responsible for it provides limited value.
My approach is to understand the existing environment first.
What governance already exists?
Where are responsibilities unclear?
Where are the genuine risks?
Which existing processes can be strengthened?
Where is something new actually required?
From there, we can build an approach that is proportionate, practical and capable of becoming part of normal business operations.
Targeted support or broader governance uplift
Privacy and data governance engagements can address a specific issue or form part of a broader governance program. You may need help completing a privacy impact assessment, mapping personal information, reviewing existing privacy controls or defining data ownership. Alternatively, you may need a broader assessment of your current governance environment and a prioritised roadmap for improvement. The engagement can be designed around the problem you actually need to solve rather than requiring a predetermined governance program.
Strong data governance supports responsible AI
As organisations increase their use of artificial intelligence, the relationship between data, privacy and AI governance is becoming increasingly important. Understanding your data provides a stronger foundation for understanding your AI risk.
If your organisation is introducing or expanding its use of AI, I can also help establish practical governance around how AI is selected, assessed, used and monitored.
Need help strengthening your Privacy or Data Governance?
Whether you are addressing a specific privacy issue, trying to understand your information environment or looking to strengthen governance more broadly, we can start with where your organisation is today.
Let's discuss the governance problem you are trying to solve.