IAPP Fellow of Information Privacy

Leaders face several legal systems at once. You compare broad and sector-based approaches, find the strictest common standard, and recognize where local rules should override a global one.

• Comparative method: broad and sectoral laws
• Rights, legal bases and notice compared across regimes
• Cross-border transfer strategy
• Designing to a baseline with local exceptions
• Tracking regulatory change without chasing every draft
• Briefing executives on a legal shift

You build A comparative brief on how three regimes treat one business practice.

A program that works for a hundred people may fail for ten thousand. You design operating models, maturity paths, metrics and tooling that grow with the organization and survive changes of staff.

• Operating models: central, federated and embedded
• Maturity models and improvement roadmaps
• Metrics that guide decisions
• Privacy tooling and automation
• Funding and staffing cases
• Embedding privacy in business processes

You build A three-year program roadmap with maturity targets and metrics.

Privacy outcomes are largely set by architecture. You take part in decisions on data platforms, identity, analytics, cloud and retention, and speak with engineers in terms of design choices and trade-offs.

• Data platforms, lakes and the cost of keeping everything
• Identity, consent and preference infrastructure
• Privacy-enhancing technologies and when to use them
• Cloud, SaaS and vendor architecture
• Privacy requirements in engineering design
• Challenging a design respectfully and with evidence

You build An architecture review that records the privacy trade-offs in one platform design.

AI projects pull privacy teams into new territory. You decide how privacy fits into AI governance, assess AI use cases for data protection risk, and coordinate with legal, security and ethics colleagues.

• Where privacy ends and AI governance begins
• Assessing AI use cases and training data
• Notices, rights and automated decisions in AI products
• Vendor AI and unsanctioned AI use
• Working with an AI governance committee
• Reporting AI privacy risk to leadership

You build A privacy position paper for a proposed AI initiative.

Executives and boards need decisions framed clearly. You describe privacy risk in business terms, set risk appetite, report on accountability, and prepare leaders for incidents and regulator contact.

• Framing privacy risk in business terms
• Risk appetite and tolerance
• Board and audit committee reporting
• Regulator relations before and during an inquiry
• Crisis leadership in a major incident
• Accountability for third parties and group companies

You build A board briefing on one privacy risk, with options and a recommendation.

Standing in the field comes from helping others do the work well. You coach colleagues, build privacy communities inside and outside the organization, and contribute to standards and public debate.

• Coaching and developing privacy staff
• Building a champions network
• Speaking and writing for a professional audience
• Contributing to standards and consultations
• Peer review and referral in the community
• Keeping your knowledge current

You build A plan for developing one team member and contributing to one external body.

Experience counts when you can describe it plainly. You analyze your own body of work, draw out the decisions that mattered, and write a clear account of how your background has prepared you for senior privacy leadership.

• Collecting evidence of your work and its results
• Choosing the projects that show judgment
• Writing about decisions, not just duties
• Showing legal, program and technology breadth
• Asking peers to speak to your work
• Reviewing and tightening your account

You build A written professional statement backed by a portfolio of your work.