Jump to: Privacy · Data Governance · Cybersecurity Compliance · Responsible AI · Digital Accessibility
Five disciplines. One Data Trust system
Organizations are expected to protect personal information, govern data responsibly, manage cybersecurity risk, deploy artificial intelligence responsibly and make digital services accessible.
These responsibilities are commonly assigned to different teams and governed through different laws, standards, policies and technologies. Each discipline requires specialist knowledge, but none operates effectively in isolation.
My expertise lies in connecting these disciplines through a common system of obligations, risk, accountability, controls and evidence.
This integrated approach helps turn complex requirements into governance arrangements that people can understand, operate and improve.
What I mean by Data Trust
Data Trust is the justified confidence that an organization handles data and digital technologies responsibly, lawfully, securely and in a manner consistent with its stated purposes.
Trust cannot be created by a policy statement or compliance certificate alone. It depends on how an organization makes decisions, assigns responsibility, manages risk, operates controls, responds to problems and demonstrates what occurred.
A trustworthy organization should be able to answer:
- What data and technologies do we use?
- For what purposes are they used?
- Which rights, obligations and risks apply?
- Who owns the relevant decisions?
- What controls are expected?
- How do we know those controls operate?
- What happens when requirements are not met?
- How do we learn and improve?
My work connects five governance disciplines that contribute to answering these questions.
The shared architecture of Data Trust
Although each discipline has its own requirements, they depend on common governance foundations.
Obligations
Organizations must identify the laws, regulations, standards, contracts, policies and public commitments that apply to their activities. These obligations must then be translated into clear internal requirements.
Risk
Governance should consider potential effects on individuals, information, technology, operations, organizational objectives and wider society. Risk provides the context for deciding which controls are necessary and proportionate.
Accountability
Decisions must have owners. Effective governance distinguishes strategic oversight, management responsibility, operational execution and independent assurance.
Controls
Requirements and risk decisions become operational through preventive, detective and corrective controls. Controls should have defined objectives, owners, procedures, frequencies and expected evidence.
Evidence
Policies describe expectations; evidence demonstrates performance. Reliable evidence allows management, auditors, regulators and other stakeholders to assess whether responsibilities and controls operate as intended.
Improvement
Governance systems must respond to incidents, findings, complaints, regulatory developments, technology changes and operational experience. Data Trust is therefore a continuing management responsibility rather than a one-time compliance project.
Data Protection and Privacy
Protecting people throughout the information lifecycle
Data protection begins with recognizing that personal information is connected to people, their rights and the effects that organizational decisions may have on them.
My approach translates privacy principles and legal obligations into accountable operational practices. It connects legal interpretation with data flows, systems, processes, vendors, controls and evidence.
The objective is to make privacy part of organizational decision-making rather than a review performed only after a product, service or contract has already been designed.
Areas of focus
- Privacy governance and operating models
- Records of processing and data inventories
- Lawful processing and purpose definition
- Transparency and privacy notices
- Individual-rights request management
- Privacy impact and risk assessments
- Privacy by design and default
- Consent and preference governance
- Personal-data breach management
- Retention, deletion and information lifecycle controls
- International data transfers
- Vendor and processor governance
- Data-processing agreements
- Privacy training and awareness
- Privacy metrics, monitoring and assurance
Professional approach
I treat privacy as an organizational system connecting people, processes, information and technology. A defensible privacy position should be traceable from the applicable obligation to the relevant processing activity, decision, control and evidence.
This approach supports legal compliance while also improving transparency, accountability and confidence in how personal information is used.
Regulatory and framework context
My work considers privacy laws and governance frameworks relevant to multinational organizations, including the EU General Data Protection Regulation, Qatar’s Personal Data Privacy Protection Law, ISO privacy management standards and recognized privacy-risk frameworks.
The applicable requirements always depend on jurisdiction, organizational role, processing context and the individuals affected.
Explore related privacy insights
Data Governance
Making data accountable, understandable and usable
Data governance establishes the authority, responsibilities and rules through which data is managed as an organizational asset and responsibility.
It extends beyond data quality. Organizations must understand what data exists, what it means, where it comes from, who is accountable for it, how it may be used, how sensitive it is and how long it should be retained.
My approach connects governance decision rights with practical information architecture and lifecycle management.
Areas of focus
- Data-governance operating models
- Governance councils and decision rights
- Data ownership and stewardship
- Data domains and subdomains
- Business glossaries and information concepts
- Data catalogues and metadata
- Canonical data elements and definitions
- Data classification and handling
- Data quality and control
- Data lineage and traceability
- Records and retention governance
- Reference and master-data governance
- Data-access and acceptable-use rules
- Data-sharing governance
- Governance metrics and issue management
- Data-literacy and stewardship programmes
Professional approach
I view data governance as a combination of authority, architecture and operational practice.
A catalogue without accountable owners becomes an inventory exercise. Ownership without clear decision rights becomes a title. Classification without handling rules becomes a label. Effective governance connects these components so that information about data leads to consistent decisions and controls.
This also creates a foundation for privacy, cybersecurity, analytics and AI governance. An organization cannot reliably assess risk or demonstrate responsible use if it does not understand the data involved.
Framework context
My work draws on established data-management, enterprise-governance and architecture practices while adapting them to the organization’s mission, systems, regulatory environment and level of maturity.
Explore related data-governance insights
Cybersecurity Compliance
Connecting security requirements, controls and assurance
Cybersecurity compliance is the disciplined translation of security obligations and risk decisions into controls that can be implemented, tested and evidenced.
It is related to—but not identical with—technical security operations. Cybersecurity teams protect systems and respond to threats. Compliance and assurance help establish which requirements apply, how responsibilities are assigned, how controls are assessed and how management gains confidence in their operation.
Areas of focus
- Security governance and policy architecture
- Control-framework development and integration
- Regulatory and standards mapping
- Control ownership and accountability
- Security-risk and compliance assessments
- Information and asset governance
- Identity and access-control governance
- Data-protection and encryption requirements
- Technology and cloud governance
- Third-party security and supply-chain risk
- Security requirements in procurement
- Evidence collection and control testing
- Internal audit and certification readiness
- Findings, remediation and risk acceptance
- Security training and awareness
- Compliance metrics and management reporting
Professional approach
I focus on the traceability between requirements, risks, controls, implementation and evidence.
Organizations frequently assess the same control several times against different standards or regulations. An integrated control structure can identify common requirements, preserve necessary differences and reduce duplicated assessment activity.
The goal is not to create the largest possible control library. It is to create a coherent, risk-informed control environment that people can operate and assurance functions can evaluate.
Standards and framework context
My work includes information-security management systems, privacy information management, widely adopted cybersecurity frameworks and integrated control-mapping approaches.
The selection of controls should reflect the organization’s risk, technology environment, contractual obligations and applicable regulatory requirements.
Explore related cybersecurity-compliance insights
Responsible AI
Governing AI across its complete lifecycle
Responsible AI governance enables organizations to use artificial intelligence while managing risks to people, rights, information, operations and organizational trust.
AI governance cannot be separated from data governance, privacy, security, procurement, intellectual property, accessibility and human accountability. An AI system may create new risks, but it also depends on governance capabilities the organization should already possess.
My approach places AI within a lifecycle extending from proposed use and acquisition through development, deployment, monitoring and retirement.
Areas of focus
- AI governance structures and accountability
- AI policies and acceptable-use requirements
- AI system and use-case inventories
- AI risk classification
- AI impact and conformity assessments
- Data and model governance
- Human oversight and intervention
- Transparency and user communication
- Bias, fairness and quality considerations
- Privacy and security in AI systems
- Third-party AI and procurement governance
- Generative AI and content governance
- Monitoring, incidents and corrective action
- Documentation and evidence requirements
- AI literacy, training and role-based awareness
- Responsible experimentation and controlled adoption
Professional approach
Responsible AI should enable informed and proportionate decision-making.
Not every AI use presents the same level or type of risk. Governance should distinguish low-risk productivity tools from systems that materially affect people, important organizational decisions, public information or protected rights.
Risk classification should determine the depth of assessment, approval, oversight, documentation and monitoring. Human oversight must also be meaningful: assigning a person to approve an AI output is insufficient if that person lacks the information, competence, authority or time needed to challenge it.
Regulatory and framework context
My work considers emerging AI regulation and recognized AI management and risk frameworks, including the EU AI Act, ISO AI management standards and the NIST AI Risk Management Framework.
These sources provide useful structures, but responsible implementation must also reflect the organization’s purpose, data, users, potential impacts and operating environment.
Explore related Responsible AI insights
Digital Accessibility
Making digital participation part of governance
Digital accessibility ensures that websites, applications, documents, media and digital services can be used by people with diverse abilities and access needs.
Accessibility is sometimes treated as a final technical test. By that stage, inaccessible design choices may already be embedded in products, procurement decisions, content workflows and technology platforms.
My approach treats accessibility as a governance and lifecycle responsibility.
Areas of focus
- Accessibility governance and operating models
- Accessibility policies and standards
- Organizational roles and accountability
- Accessibility requirements in procurement
- Accessible design and development practices
- Accessible content and document workflows
- Video, audio and multimedia accessibility
- Conformance testing and evidence
- Accessibility statements and feedback mechanisms
- Issue management and remediation
- Third-party platform and supplier accessibility
- Training for designers, developers and content teams
- Accessibility metrics and monitoring
- Integration with privacy, security and AI governance
Professional approach
Accessibility must be considered when a service is planned, designed, purchased, developed, populated with content and changed—not only when it is tested before release.
Clear standards are necessary, but sustainable accessibility also requires ownership, competence, quality controls, feedback routes, remediation processes and management oversight.
Accessibility governance should recognize both technical conformance and the real experience of people using digital services.
Standards and regulatory context
My work considers internationally recognized accessibility guidance and standards, including the Web Content Accessibility Guidelines and accessibility requirements applicable to digital products and services.
The precise obligations depend on jurisdiction, service type, sector and intended audience.
Explore related digital-accessibility insights
How the disciplines connect
The strongest governance outcomes emerge at the intersections between these disciplines.
Artificial intelligence
An AI use case may require:
- Data governance to establish data ownership, provenance and quality
- Privacy analysis when personal information is involved
- Cybersecurity controls to protect systems and models
- Responsible AI assessment and human oversight
- Accessibility review for affected interfaces and content
Third-party technology
A technology supplier may require:
- Data and system classification
- Privacy-role and processing analysis
- Security due diligence
- Contractual controls
- AI-use disclosure
- Accessibility requirements
- Monitoring and evidence throughout the relationship
Data lifecycle management
A lifecycle decision may involve:
- Business and legal purpose
- Data ownership
- Privacy-law requirements
- Security classification
- Retention obligations
- AI training or reuse restrictions
- Accessibility of archived information
- Evidence of deletion or disposal
These examples demonstrate why isolated programmes can create gaps. The same activity may create responsibilities across multiple disciplines, even when different teams remain accountable for specialist decisions.
Core professional capabilities
Across the five disciplines, my expertise centres on six connected capabilities.
Governance architecture
Designing governance bodies, roles, decision rights, escalation routes and policy structures.
Obligation and control traceability
Connecting laws, standards and policies to requirements, controls, owners and evidence.
Operating-model development
Translating governance expectations into processes, workflows, responsibilities and supporting technology.
Risk and assessment design
Developing proportionate methods for evaluating activities, systems, suppliers and organizational decisions.
Evidence and assurance
Defining what demonstrates control operation and how evidence can support monitoring, audit and management confidence.
Capability building
Helping professionals understand not only what a requirement says, but how to apply it within their roles and operating context.
My perspective
I do not believe that every organization needs the same governance model.
A suitable approach depends on the organization’s mission, jurisdictions, technologies, data, risk, scale, maturity and the people who may be affected by its decisions.
However, effective Data Trust programmes share several characteristics:
- Accountability is explicit.
- Requirements are traceable.
- Risk decisions are documented.
- Controls are operationally realistic.
- Evidence is reliable.
- Specialist disciplines remain connected.
- Problems lead to corrective action.
- Governance adapts as the organization changes.
This is the standard against which I evaluate governance design: not how comprehensive it appears on paper, but how effectively it supports responsible action in practice.
Explore my work
See how these principles are applied through selected, non-confidential examples of governance transformation and professional practice.
For analysis of emerging laws, standards, technologies and governance methods:
For speaking, research, academic or professional enquiries:
Professional disclaimer
LGLNOW is my independent professional and educational platform. Views expressed are my own and do not represent the views of any current or former organization with which I have been associated.
The material on this page is provided for professional and educational purposes. It describes general governance approaches and does not constitute legal, technical or other professional advice.