Blog · PURPOSE AND MEANS

Blog

Latest insights on data protection, AI governance, and GRC leadership.

8 Dec 2025 · 6 min read

Beyond Legal #14: Does your RoPA really show how your company processes personal data? (Why you need business analysis skills)

Your Record of Processing Activities (RoPA) is a solid foundation. Now, let’s bring it to life by swapping legal questions for operational essentials.

3 Dec 2025 · 8 min read

Beyond Legal #13: From signed contracts to trusted partnerships

How mastering vendor management turns “third-party risk” into “third-party value” in an age of AI and Data Sovereignty.

27 Nov 2025 · 4 min read

Know your Game Plan from your Roadmap

We often confuse a schedule with a strategy, but while a roadmap tells you when a project finishes, only a Game Plan explains how you effectively succeed.

10 Nov 2025 · 4 min read

From issues to action: a playful, practical workshop for Data Protection Day 2026

When a financial services Data Protection Leader needs to unite 37 entities across multiple countries for a critical 2026 planning session, we're including some elements of play.

5 Nov 2025 · 14 min read

Beyond legal #12: From headless chickens to coordinated data breach response - why operations beat legal theatre

In this twelfth post of my "beyond legal" series, I'm addressing what many data protection professionals dread: that call you get after you've just finished your third glass on a Friday night. Some breach response plans look impressive in binders gathering dust, but fall apart the moment someone accidentally shares a database containing millions of customer records, or when ransomware locks down your production systems at 2am on a Saturday morning.

30 Oct 2025 · 8 min read

How to build a Future Radar that actually works

I've been designing and facilitating workshops, and practicing business analysis for decades. After developing a radar covering the future of this field, a few things stood out prompting me to update my personal development plan for 2026.

26 Oct 2025 · 9 min read

Beyond legal #11: Stop counting activities and start measuring outcomes

In this eleventh post of my "beyond legal" series, I'm addressing perhaps the most forgotten about competency in data protection leadership: the ability to measure what actually matters. Many data protection functions are stuck in a rear-view mirror mindset, counting compliance activities instead of driving forward-looking performance that demonstrates real business value.

23 Oct 2025 · 4 min read

Data Protection Day 2026 as your strategic launchpad

Data Protection Day, often seen through a legal lens, is a tremendous opportunity for data protection leaders to ignite a year-long, company-wide culture of data stewardship that goes way beyond compliance.

7 Oct 2025 · 4 min read

GRC leaders: how our workshop approach can help you plan for 2026 and beyond

Our versatile "From Issues to Action" workshop approach has many uses. For example, to proactively address regulations like the EU AI Act, DORA, and NIS2, to uncover internal challenges, assessing practice maturity, or integrating stakeholder viewpoints. All this can feed into your 2026 operational plans and budgets.

2 Oct 2025 · 9 min read

Beyond legal #10: The battle for minds - why your data protection training needs an advertising makeover

Most data protection training fails not because employees don't care about the subject, but because it's often designed by lawyers for lawyers. It's time to learn from the masters of human psychology - advertisers - and start moving employee engagement away from compliance checkboxes into a creative challenge.

23 Sep 2025 · 10 min read

Beyond legal #9: Get to know your SDLC

If you are spending most of your time reviewing contracts and updating RoPAs instead of influencing how your software and products get built you need to get your hands dirty with your SDLC.

18 Sep 2025 · 8 min read

Beyond legal #8: Why your next hire should be a data protection engineer

Move beyond generic privacy notices, compliance bolt-ons and theatre. Bring in a data protection engineer who embeds data protection considerations like minimisation, retention & deletion, monitoring and usable controls into your products and services.

12 Sep 2025 · 12 min read

Beyond legal #7: You can't protect what you are not aware of

Many data protection leaders view their RoPA merely as a compliance mechanism, often leading to outdated, siloed information and missed opportunities. A strategically positioned RoPA can be your company's indispensable data map vital for understanding your data landscape.

3 Sep 2025 · 8 min read

Beyond legal #6 : The great governance misunderstanding

The failure to differentiate between governance and management is not an academic debate. It is the root cause of companies finding themselves in crises, asking themselves "How on earth did we end up here?"

28 Aug 2025 · 9 min read

Beyond legal #5: Get to know your data management and data governance colleagues

Data protection leaders must evolve beyond a purely legal and compliance-based role by familiarising themselves with the principles of data management and data governance. To succeed, they must collaborate with technical and business teams, shifting their narrative from risk avoidance to one that enables innovation and builds trust as a competitive advantage.