What I can help you with.

As a mandatory DPO under Art. 37(1)(b) GDPR, I understand what the role actually requires. I act as an appointed DPO — full-time, fractional, or interim — from formal appointment and regulatory correspondence through to ongoing programme oversight and staff guidance.

I conduct Article 35 DPIAs and Transfer Impact Assessments grounded in EDPB Recommendations 01/2020 (EU TIA) and ICO guidance (UK TRA). This includes assessing third-country legal frameworks — US (FISA §702, EO 12333, CLOUD Act), India (IT Act §69, DPDPA 2023), and others — with documented supplementary measures where needed.

International transfers require precision — the wrong module, a missing docking clause, or an unaddressed transfer route creates real regulatory exposure. I draft and negotiate the full documentation suite: IGDTA incorporating EU SCCs (Decision 2021/914) across all applicable modules (C2C, C2P, P2SP), UK IDTA, India Accession Agreements, and third-party DPAs.

Leading a GDPR Art. 42 certification programme means far more than filling in a checklist. I manage the full lifecycle — defining the Target of Evaluation, scoping the certification perimeter, preparing all certification documentation, coordinating with certification consultants and auditors, and ensuring your product meets the standard across every applicable jurisdiction.

AI features create privacy questions before they create AI Act questions — what data trains the model, what data goes in at inference, what users are told, and whether a DPIA is triggered. I bring established privacy expertise to AI features, with AI Act readiness scoping as an emerging capability that I partner on with dedicated AI compliance specialists for deeper conformity work.

Privacy operations break down in practice when intake is unclear, SLAs aren't tracked, and handoffs between teams aren't documented. I design and implement DSAR programmes that scale — from intake triage and identity verification through to response drafting, SLA tracking, and backlog clearance.

Privacy by design isn't a box to tick at the end of a sprint. I work cross-functionally with Product, Engineering, and Support teams to embed privacy controls into the development lifecycle — data flow mapping, data minimisation reviews, and privacy-aware feature design.

Compliance documentation is only useful if it reflects actual practice and covers every legal requirement. I draft, review, and remediate privacy notices, cookie policies, retention schedules, ROPAs, and DPAs — identifying gaps against GDPR, UK GDPR, CCPA, and HIPAA with specific, actionable findings.