5 August 2026
Most Data Protection Challenges Are Not Legal Challenges. They’re People Challenges.
By Jess Pembroke, Director of Information Law Services
A hot topic now is whether AI will replace jobs and in particular, can an “AI agent” do the same as my role? Will people come to me with questions or just ask a chatbot? If you are seeking information about data protection, there have always been plenty of ways to learn what the law says. You can read the legislation, explore guidance published by the Information Commissioners Office (ICO), attend legal briefings, or use a Seach engine to help. I would like to think that for at least the short term, my skills (if not necessary my knowledge) are what keep our clients coming to us for advice. The challenge most organisations face is not access to information about the law. The challenge is translating that knowledge into practical actions that become part of everyday business operations.
Very few organisations deliberately decide not to comply with data protection law. The reality is usually much more complicated:
- Records aren’t destroyed because nobody owns the retention schedule
- A DPIA isn’t completed because a project team didn’t realise they needed one
- A supplier is appointed without adequate due diligence because procurement wasn’t sure what questions to ask
- Marketing isn’t quite clear about consent requirements but went live with a new campaign due to pressure to get more engagement.
The challenge is rarely knowing what the law says. The challenge is getting people to act on it.
That means building relationships across the organisation. It means understanding priorities that may not initially appear connected to privacy and data protection. It means communicating risk in a way that resonates with senior leaders. It means helping colleagues understand that privacy is not a barrier to success, but an essential part of doing things well.
If you’ve ever felt frustrated because nobody told you about a new project until the contract was signed, procurement engaged a supplier before privacy due diligence was completed, staff continue to hold records beyond their retention periods, senior leaders only become interested after an incident, or your organisation sees data protection as “the DPO’s responsibility”, then you’re certainly not alone. These are the kinds of challenges that privacy professionals wrestle with every day.
And they are exactly the kinds of challenges explored through the online Advanced Certificate in Data Protection, which we run at Naomi Korn Associates.
Throughout our courses the focus is always on the practical question: How do I make this work in my organisation?
- How do you build relationships that ensure privacy is considered before decisions are made?
- How do you engage senior leaders and secure support for compliance activities?
- How do you improve procurement processes so that privacy questions are asked at the beginning rather than the end?
- How do you create awareness and training programmes that genuinely change behaviour?
- How do you develop meaningful accountability rather than simply producing documentation?
- How do you prepare for incidents and help your organisation respond effectively when things go wrong?
- And perhaps most importantly, how do you influence people when you have responsibility without direct authority?
The course is highly interactive because some of the most valuable learning comes from sharing experiences with fellow practitioners. Delegates bring real-world challenges, discuss practical solutions and learn from professionals working in different sectors who are often facing remarkably similar issues.
You won’t leave with a detailed memory of every article and recital within the GDPR. You will leave with something much more useful: a practical framework for implementation, greater confidence in influencing stakeholders, ideas and approaches you can adapt within your own organisation, a draft implementation plan, and the benefit of learning alongside other practitioners who understand the realities of the role.
Because success in data protection is not simply about understanding the law. It’s about helping other people understand why it matters and turning compliance into action.
If that sounds like the challenge you’re facing, I’d love to welcome you to the Advanced Certificate in Data Protection, next running across September:
- Part 1: 2 September (9:30am-1pm)
- Part 2: 3 September (9:30am-1pm)
- Part 3: 7 September (9:30am-1pm)
- Part 4: 10 September (9:30am-1pm)