Fractional DPO
Named data privacy leadership without the headcount. This is the full role, part-time: governance decisions, regulator contact, escalation ownership and the day-to-day judgement calls that a program generates whether or not someone is there to make them.
- Named contact for supervisory authorities and internal escalation
- Decision ownership for lawful basis, transfers, retention and assessment outcomes
- Board and executive reporting on data privacy risk
- Breach command when an incident lands
Building the team
Where the intent is to bring the function in-house, the engagement is designed to end. That means defining the roles, hiring against them, running the function alongside the new team, and handing over documentation they can operate without me.
- Operating model and role definitions sized to your estate
- Hiring support — role specifications, technical assessment, interview structure
- Runbooks, decision registers and escalation paths
- Structured handover with a defined end date
Culture
A data-privacy-aware culture is not a poster campaign; it is what happens when the easy path and the compliant path are the same path. Most of that work is removing friction from the compliant option rather than adding rules to the other one.