Small Bites for Privacy Leaders

The GDPR requires the Data Protection Officer (DPO) to report to the highest management level. However, it does not answer the practical questions:

How often should a DPO meet with the CEO? Which reporting formats are effective? Which topics should be escalated to senior management? How can the DPO create a relationship that brings value to both the organization and leadership?

In this first session of the Small Bites for Privacy Leaders series, I share practical insights from my experience as a Group Data Protection Officer, building privacy governance structures and creating effective communication channels between privacy and executive leadership.

Product teams are under constant pressure to innovate, launch quickly and continuously improve. Privacy professionals are expected to ensure compliance and build trust.

But are these two goals really in conflict?

In this webinar, I explore what I believe is one of the most important relationships for every Privacy Leader: the relationship between the Data Protection Officer and Product.

Together we'll discuss how to involve Privacy early without slowing down innovation, why Privacy by Design is a business advantage rather than a compliance burden, and practical ways to build trust between Product and Privacy. We also cover risk-based decision making before and after product launch — plus privacy features that actually improve the customer experience.

This session is designed not only for Privacy professionals, but also for Product Managers, Product Owners and anyone building digital products.

Privacy should not be Product's blocker. It should become Product's trusted partner.

When new IT systems are introduced, employee-related policies are developed, or rules around the use of technology and monitoring are negotiated, the DPO is rarely the only function looking at employee privacy.

In Germany, the Works Council (Betriebsrat) has a particularly strong and legally defined role. In other countries, the legal structures and powers may differ, but similar situations can arise with employee representative bodies, staff councils, unions or other forms of employee representation.

Different mandates. Different expertise. But often the same projects, the same employees – and many of the same questions.

In this Small Bite for Privacy Leaders, we explore:

Where do the responsibilities of the DPO and employee representatives overlap?

Who brings which expertise to the table?

Who should advise whom?

How can both sides collaborate without compromising their independence?

How can we avoid duplicate reviews, conflicting assessments and asking business teams the same questions twice?

And what could a practical joint process for new systems, policies and employee agreements look like?

My central thesis: Independence does not mean isolation.

A DPO does not need to take over the role of employee representation – and employee representatives do not need to become a second DPO.

Good governance starts when both sides understand their mandate, contribute their expertise and engage with each other early.

Privacy and IT Security share one goal: protecting personal data effectively. But who is responsible for what — and where do DPOs and IT Security need to work together?

In this Small Bite for Privacy Leaders, I explore why a strong DPO does not need to become an IT Security expert — and why close collaboration between both functions is nevertheless essential.

In this episode, we look at:

Where the boundaries between privacy law and data security lie

Why we need two experts — but have one protection goal

How Privacy and IT Security can collaborate on technical and organisational measures (TOMs)

How to design an effective incident process and when to involve the DPO

Which policies Privacy and Security should develop together

Why clear ownership internally and one trust story externally belong together

My key message:

Clear ownership inside. One trust story outside.

Because ultimately, customers and users have one simple question:

Can I trust you with my data?