Practical Privacy with Orla Dormer
Practical Privacy is a podcast for privacy professionals who want to understand how privacy and AI governance work in the real world. Hosted by Orla Dormer, the series brings together experienced practitioners to discuss common operational challenges, from scaling GDPR programs and answering data questions internally, to navigating AI governance and legacy tooling constraints.Each episode focuses on practical lessons, honest reflections, and what teams wish they had known earlier. This podcast is designed as a reference for privacy leaders looking to improve how privacy actually operates inside organisations.
10
Governance Is a Design Language, Not a Checkpoint | Onur Korucu
Why do engineering and legal teams so often feel like they’re working against each other? In this episode of Practical Privacy, Orla Dormer speaks with <b>Onur Korucu, Non-Executive Director at DataRep</b> and IAPP Emeritus Fellow, about the core tension between engineering and law and governance teams. <br /><br />Onur explains why the real challenge is a clash of worldviews, with deterministic engineering logic on one side and context-dependent law and governance on the other. She also shares why rigid, by-the-book compliance created friction, and how treating governance as a design language rather than a final checkpoint changed th...
Incident reporting isn't a tick-box exercise | Dave Evans
GDPR, NIS2, DORA, US state laws and now AI incidents. How do you build one incident management model that keeps up with all of them?<br /><br />In this episode, Orla Dormer welcomes back her first ever guest, <b>Dave Evans, Group DPO at Ultradome</b>, to talk about centralising incident management across regulations and jurisdictions. Dave explains why his team moved to a user-friendly collection form, why a "four-eye" review is essential, and where AI can help with the analysis without replacing human judgement.<br /><br />The conversation also covers turning incident data into KPIs, training and dashboards, and...
Privacy teams are the business, not an add-on | Delizia Diaz
"Can we just get a quick privacy check before we go live next week?" Getting genuine engagement from the business is one of the most persistent challenges in privacy.<br /><br />In this episode, Orla Dormer speaks with Delizia Diaz, Senior Privacy Counsel and external consultant to companies including McLaren Automotive and FDJ United, about moving from reactive to proactive privacy. Delizia explains why fear-based messaging and going it alone don't work, how to build allies with the CISO and Chief Data Officer, and why privacy teams need to market themselves as business enablers. <br /><br />The conversation also covers...
Why Privacy Can't Just Be a Compliance Checkbox | Vicky Owens
Too many stakeholders treat data privacy as a regulatory checkbox — tick it, forget it, move on. <br /><br />Orla Dormer talks with Vicky Owens, Data and Digital Senior Counsel at SkyShowtime, about why that mindset fails and how to fix it. Vicky shares why the classic "fines and reputational risk" pitch often doesn't land, and how reframing privacy around return on investment — better data, monetisation, competitive edge — changes the conversation. She also shares a real example: how spotting a spike in incidents among contractors led to a training fix that cut incidents by 45%. <br /><br />📌 Subscribe for more real-world conversations on privac...
Engage Regulators Before They Come to You | Francisco Matos
<br />New cybersecurity regulation like NIS2 is landing differently in every EU country — and a single incident can now trigger separate reports under multiple frameworks. <br /><br />Francisco Matos, Compliance Director at Legora and former Associate General Counsel for Cybersecurity Law at Meta, joins Orla Dormer to explain how his team turned that fragmentation into a proactive regulator engagement strategy: cold outreach, a focused paper that got them invited to present at ENISA in Amsterdam, and lessons on building trust with regulators before you need them.<br /><br />📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compl...
Building an AI agent governance framework at scale | Monika Tomczak-Górlikowska
Orla Dorner is joined by Monika Tomczak-Górlikowska, Group Head of Privacy, Digital & AI Governance at Prosus, to talk about building an agentic AI governance framework at scale. <br /><br />They discuss why traditional governance controls aren't enough once anyone in an organisation can build an AI agent, how to shift from one-off assessments to continuous risk monitoring, and why staying close to high-risk teams like HR and finance is critical as adoption accelerates. <br /><br />🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/<br /><br...
Automating processor RoPAs & proving privacy's business value| Adrien Hug-Korda
Keeping a processor Record of Processing Activities up to date is one of the least glamorous—but most critical—operational challenges in privacy. <br /><br />In this episode, Orla Dormer is joined by <b>Adrien Hug-Korda, European Data Protection Board Expert and former Privacy Director at Contentsquare</b>, to discuss how privacy teams can automate processor RoPAs, manage large-scale processing operations, and build compliance processes that continue working as organisations grow. <br /><br />Adrien shares practical lessons from the digital marketing industry, explains how to avoid creating compliance processes that rely on constant manual effort, discusses handling DSRs in cookie-based envi...
Operationalising AI governance in a high-growth fintech environment | Taylor Galusha
<b>What does practical AI governance actually look like day to day in a high-growth FinTech environment?</b><br /><br />In this episode of Practical Privacy, Orla Dormer speaks with <b>Taylor Galusha, Lead Privacy and AI Counsel at Chime</b>, about operationalising AI governance through scalable AI vendor assessments.<br /><br />Taylor explains why manual reviews are difficult to sustain, how robust playbooks can create consistency, and how AI can support the first draft of vendor assessment reviews when given clear guidance, examples, and logic trees.<br /><br />This episode explores how privacy and AI governance teams can move...
Why privacy programmes fail to scale | Cristina Costache
Most organisations have privacy policies. Far fewer have privacy capabilities that actually scale. <br /><br />In this episode, <b>Cristina Costache, DPO & CISO at Noventiq</b>, explores one of the most persistent challenges facing privacy teams: transforming compliance from a documentation exercise into an operational capability embedded within the organisation.<br /><br />📌 Subscribe for more real-world conversations on privacy operations, AI governance, and scaling compliance without the noise.<br /><br />🟡 TrustWorks reduces operational drag through context-aware operations that align compliance with how the business actually works. Learn more at https://www.trustworks.io/
Scaling ROPA, PIAs & privacy documentation across 1,000+ applications | Aaron Mendelsohn
How do you complete privacy documentation across hundreds of teams and more than 1,000 applications without overwhelming the business? In this episode of Practical Privacy, Orla Dormer is joined by <b>Aaron Mendelsohn, Director and Senior Privacy Officer at The LEGO Group</b>, to discuss how his team rebuilt and scaled privacy documentation across a large global organisation. <br /><br />Aaron explains how they combined privacy technology, risk-based prioritisation, and extensive team enablement to successfully document over 1,000 applications within a 12-month period. He also shares why privacy professionals need to move beyond policy writing and spend more time understanding how product...
