Padraig: 00:00

Automation works when it's built by those who know the workflow best, not by IT or developers in another team or department. Are we building this because it allows us to sell something else to another team? Are we adding complexity for business reasons and not focusing on what are the needs of the privacy team? When I hire, I'm always asking myself, what is this person bringing that we don't already have?

Intro: 00:28

Are you ready to know what you don't know about Privacy Pros? Then you're in the right place.

Intro: 00:33

Welcome to the Privacy Pros Academy podcast by Kazient Privacy Experts, the podcast to launch progress and excel your career as a privacy pro.

Intro: 00:44

Hear about the latest news and developments in the world of privacy.

Intro: 00:47

Discover fascinating insights from leading global privacy professionals, and hear real stories and top tips from the people who've been where you want to get to.

Intro: 00:58

We're an official IAPP training partner.

Intro: 01:03

We've trained people in over 137 countries and counting.

Intro: 01:07

So whether you're thinking about starting a career in data privacy or you're an experienced professional, this is the podcast for you.

Jamal: 01:24

Hello, and welcome to another episode of the Privacy Pros podcast. My name is Jamal, and I'll be hosting you today. And on the show today, we've got a fantastic guest. In fact, it's someone I've actually been fortunate to meet in person. And we were at the RISK exhibition together and really got on. And his passion for operationalizing privacy and the challenges of solving irt inspired me so much. I was like, Padraig, we have to bring you onto the podcast. And I've actually given the name of our guest away, so let me go ahead and introduce him. Padraig O'Leary is the co-founder and CEO of QueryLayer, a privacy automation platform for scaling businesses and enterprises. He is passionate about promoting the legal and ethical use of data in the enterprise. Dr. O'Leary was a research fellow at the Irish Software Research Center, Head of Data at the Center for Applied Research in Connected Health, and Assistant Professor for Software Engineering at the University of Adelaide. Padraig, welcome to the Privacy Pros Podcast.

Padraig: 02:18

Jamal an absolute pleasure. Thank you very much for the invitation.

Jamal: 02:22

Right, so Jamilla is not here today. She's not feeling well, so we hope she gets better. But if she was here, she would have loved to ask you what is your favourite flavour when it comes to chips or crisps, whatever you want to call them?

Padraig: 02:34

Oh, my. In my younger days in Ireland, chicken curry and chips were a big favourite, particularly after a late night. That's going to be my answer. Chicken curry chips.

Jamal: 02:45

What about now?

Padraig: 02:47

Now, I’m in a, I think a slightly more health conscious, I guess, not eating as many chips.

Jamal: 02:53

It’s not part of the diet anymore. Good stuff. Cool. Guys, top tip from Padraig. If you want to be an amazing privacy professional, you need to focus on your health and what we need to do is cut out those chips, cut out those crisps. So my question is, I've just read out your bio. You've had so much academic experience. How did you then move from academia into actually privacy? What got you into privacy in the first place?

Padraig: 03:20

There was a number of projects I worked on in the past which had quite like sensitive data was key components and handling sensitive data. I think probably the formative experience for me was a start-up that I worked on. So I built a start-up that worked with facial expression technology.

Jamal: 03:39

Oh, wow.

Padraig: 03:40

Yeah, it was a platform that connected facial expression reading to online survey companies. So this allows us to capture people's emotional reaction as they interacted with digital content. It was about ten years ago at the time. It was quite new and none of the major cloud providers were providing it. I suppose there was something that possibly did not sit that well with me with this whole space. Some of the very early computer vision models back then, they demonstrate a lot of bias. And the further you went down the rabbit hole of measuring people's reaction to digital stimuli and using those reactions to try profile these into buying personas, the more uncomfortable it felt. Eventually the company was actually acquired mainly because of some of the core technologies that we built. But I guess from that experience, I made a promise to myself that the next start-up that I worked on was going to work much harder at promoting the better use of personal data. And I think my move into QueryLayer was probably motivated by that experience in the darker arts, I guess.

Jamal: 04:46

That's quite a fascinating story. Thank you for sharing that Padraig. Here's one more interesting fact before we jump into QueryLayer about facial expression. So when I was researching into this and seeing how facial recognition and emotional expression is actually used, I came across a study by a University in Canada, I believe, and they had said, okay, when it comes to facial expression, it's based on the features you have on your face. So we have our eyebrows, we have our eyes, we have our nose, we have our mouth, and we have our lips. And they said, look, when it comes to actually mapping those expressions and understanding it, there's one feature that is more important than all of the other. Do you know which one that is, Padraig?

Padraig: 05:22

I'm going to say corner of the eyes.

Jamal: 05:24

It’s the eyebrows.

Padraig: 05:26

I was actually going to say eyebrows.

Jamal: 05:30

I found that quite fascinating. I thought it'd have been something more like maybe like the eyes or something, but it turns out it’s the eyebrows. My top tip at the end of the session really was if you don't want machines to read your expressions, shave your eyebrows.

Padraig: 05:46

I guess that's why they have the expression of lying eyes, so you can fake other emotional responses, but the eyes always reveal soul I guess.

Jamal: 05:57

All right, so tell us more about QueryLayer. What does QueryLayer actually do and who is it right for?

Padraig: 06:01

QueryLayer is a software platform that helps teams to operationalize their privacy programs with actionable data map and workflows for cross functional teams. So our philosophy is to focus on helping teams automate the tools that they already have within their organization. So an example would be when it comes to DSR management, our customers would use QueryLayer to orchestrate the existing tools and ticketing systems that they have. And so we're not trying to push in a new solution. It's like, okay, so how can we leverage the tools you already have and make them work for the privacy program? Automation works when it's built by those who know the workflow best, not by IT or developers in another team or department. So QueryLayer itself is no code workflow building. So giving like frontline privacy team members, automation superpowers, that's the core idea.

Jamal: 06:56

Okay, well that's amazing. Essentially the businesses have different tools they might be using, they might be doing some processes manually where they have existing tools. QueryLayer comes in and says hey, we can help you really map this and do a workflow. So now it becomes automated and because it's actually no code, you don't need the IT developers to build it so things don't get lost in technical translation. It's actually the people who are using it. It's an easy peasy way of automating it and being able to respond to those faster. So for example, when a Data Subject Access request comes in, you have a month to make sure you get it done. But if you've got high volume, if you've got seasonal volumes because something's happened, then that can often get quite challenging. And for my privacy colleagues, don't worry, we know it does get a little bit stressful because you want to make sure it’s done right because the single biggest source of investigations from data supervisory authorities, from campaigns seems to be when a Subject Access request hasn't been responded in a timely manner. And so if we can eliminate that, it's going to take out a lot of the extra work that comes along with that, alleviate the stress and make you feel like, hey, I'm a super privacy pro. All of this happens by magic. What kind of business is this right for Padraig?

Padraig: 08:02

Scale ups, companies that are heavy users of cloud services, they are a particularly good fit for the type of solution that we provide. But really it could be any type of company, any place where you have a privacy or data protection team who are looking to build a privacy program, then a solution like Quer Layer can really help. I think one of the things to note, Jamal, is that the starting point for any of these is still a comprehensive data map. Before you even think about automation or operations or workflows, you need to know what personal data you have and where it sits. There's two, I suppose, conventional approaches to solving the data map problem. The first is manual mapping, which is slow, or the alternative is e-discovery, which is invasive. Right. So, e-discovery, you're going in, you're sampling, you know, real individuals data in order to build a picture of the types of data. And both are quite expensive, both in terms of time and cost. And so before we even start talking about workflows, we like to do like responsible data discovery. So something where we promote rapid discovery of a data map, leveraging the existing systems that you have within the organization to build a picture of the personal data, and to do this in a low risk way by not actually touching personal data, by looking at how that data is described. So effectively, what we're doing is we're mapping the metadata of your system to build that data map.

Jamal: 09:41

Got it. That's a really added bonus there is essentially going back to what we teach at the Privacy Pros Academy, like, whenever you do something, we talk about the C-Five methodology. And this is essentially everything we teach our mentees, and we do in practice on the consultancy side. And the first C of that C Five methodology is clarity. If you have no idea where the data is, what data you're processing, what you're doing it for, then it doesn't matter what tools you have, it doesn't matter what you do. There’s never going to be confidence in what you're doing. And you're always going to be worried that you're not compliant. So by doing that mapping, first of all, in a way that isn't manual, so it's not taxing and it's not costing lots of money, and you don't have to hire lots of BAs and bring them in for contracts and stuff, you can actually use something like QueryLayer to map all of that. And the benefit of using QueryLayer over some of the more conventional tools is that it's less invasive. It's not actually go and touch and scan and see all the data. It's something that is done in a more respectable way. Does that sound about right?

Padraig: 10:37

Yeah, very good Jamal exactly.

Jamal: 10:39

Perfect. So then once we have the clarity, brings us onto our second see, which is confidence. Now the privacy team is confident. We understand what the processes are, we understand what data we're collecting, we understand how we're using that data, we understand who gets access to that data, we understand who we share that data with, and we also understand what happens at the end of the life cycle and how it actually gets deleted. And all of that will get actually mapped into QueryLayer. And then you go into mapping the separate processes, the operationalization of the actual privacy processes, and then you can actually automate that. Is that the kind of journey you go on?

Padraig: 11:14

Yeah, exactly. Jamal yeah. So start with data mapping. And this is a real scoping exercise. If you're going to build a privacy program, then you need to know the scope of the challenge for that privacy program. And that's why data mapping is always the first step. And then once you have a data map, once it's comprehensive and it's accurate, then you want to maintain that data map because all data maps drift over time, system changes. The type of personal data that is being processed by these systems drift, it changes, and so do the processing activities associated with these data repositories. So the second step is then maintaining your data map. And then the third step is, okay, so now we have a data map. It's accurate, it's maintained. So now what are the types of operations that we want to build on top of this data map? What's the type of reoccurring work that consumes a lot of our time as privacy professionals or team members? And how can we leverage automation or human in the loop automation, as we like to call it, to become more effective, efficient in how we run the privacy program day to day.

Jamal: 12:27

All right, awesome. So basically three steps to success. Number one, do the mapping. Number two, now you've done the mapping, do the assurance to make sure that it's up to date and you're maintaining it. So all changes are being inflected. And then three is, how do we make it easy peasy to automate that and get it done now that we know what's going on?

Padraig: 12:43

Exactly. As a company, we're two years old, so we're a younger solution. And I suppose in this whole privacy space, we're also like a smaller company with more limited resources, which forces us to be quite, I suppose, subjective and opinionated about how you would design a solution for privacy teams that this sort of natural limitation on resources actually delivers, I think, some quite interesting results. It forces you to deliver a solution that is very lean, that focuses on the simplest ways to deliver maximum value. Privacy as a space is incredibly complicated. What I see is that a lot of the existing solutions mirror that complexity. So we see a lot of complex enterprise B2B software that are like super configurable. But that types of configurability in the solution, it comes with a cost. And that cost is the time of the privacy teams in order to adapt that solution to their context. And that's why we focus really on simplicity and time to value. And that three step approach that you just mentioned there, we see that as the most effective and the most efficient way for a privacy program to get up and running. We support that both in what we do and the solution that we provide.

Jamal: 13:58

Yeah, I love that simplicity factor. I mean, you’ll hear we talk about easy peasy all the time, that's kind of the heart of everything that we do. We need to make this easy peasy easy peasy for the clients, easy piece for the customers, easy peasy for everyone involved and what it sounds like is Query Layer, you’ve taken that easy peasy and you've really looked at what's on the market and saying, what are the challenges people have when they go and get a tool and a solution? You know what, it's going to take too long to learn. They need to have some kind of technical expertise or skill to be able to actually use this. I've got so many clients who are really frustrated. They've gone and got the tools because they were sold by the advertising. But now they realize that number one, they don't have the time, number two, they don't have the skills and number three, they don't have the know how to actually get the benefit of this. So they're tied in and at the end, what do they do? They don't actually renew those products. When you go and get a product that's easy peasy, you don't have to buy additional resources and eat in to your budget, but it's actually simple as one, two, three and easy peasy. Then you can see how you can actually start adding those benefits actually by automating it once you've got the mapping in place, it actually frees you up for more time so you can focus on the things that are going to move the needle to get a privacy program for where it is right now, to the next step you have and actually get more hands on with some of the things that you've been putting off because you've been so busy responding to requests and doing some of the other assessments.

Padraig: 15:12

Exactly. And I think privacy is such a complicated space. I think we all know that so many layers of complexity that the last thing you want to be doing when you're building like a solution or a privacy program is just adding other layers of complexity on top of that. It's something that we focus really hard in is how can we make this I don't want to use a bad word, so I'm going to say as almost this kind of aggressive focus on simplicity. So anything that we think about doing, we're asking really, what is the value to the privacy team? Like, are we building this because it allows us to sell something else to another team? Are we adding complexity for business reasons and not focusing on what are the needs of the privacy teams on that? I think the first need is simplicity.

Jamal: 16:02

Lots of people listening will be like, okay, this is actually going to solve a lot of my problems and I want to explore this. If somebody wants to come and have a look at how the tool works or get in touch with you, what is the best way for them to get an idea of what the potential is and how it could actually help them in their privacy program.

Padraig: 16:18

Yeah, sure. Jamal so when you invited me on this podcast, I was delighted and I was thinking, well, is there something that maybe we could do in return? So I'd like to take the opportunity to offer all privacy pros listeners a complementary data GAP analysis. So if you're a privacy team, then we will do an exercise that will basically build a detailed inventory of your data repositories, both internal and external, so including your shadow IT, and then compare it to your existing data map and records of processing activities. So a type of sanity check for your existing data map. We will then produce a report for you which will identify which repositories do not have an associated processing activity, and then help you to identify the tasks, the prioritization based on the level of risk associated with each repository and completely free of charge. And if there's anyone out there who just wants to sanity check existing data map, their existing ROPA, then we'll be very happy to help them.

Jamal: 17:24

Let me get this right. You've just offered to do a GAP analysis on people's records of processing activities, both internal and external, including any shadow IT support services they may have. Then you're going to put all of that into a report so they can compare what they have against the report to see if there's any gaps, and you're going to do all of that for no charge whatsoever?

Padraig: 17:46

Exactly. Jamal exactly. Yeah.

Jamal: 17:48

Guys, Christmas has come early. Now, Padraig, this popular goes out to about 10,000 engaged listeners every month and we think we're in over 124 countries and counting. So guys, if you want to take advantage of this crazy offer, I don't think Padraig knows exactly what he's just given away. But if you want the opportunity to get a GAP analysis, get clarity in your program so you can get that clarity. Be confident that the data mapping is actually reflective of what it should be so you can move forward with credibility across the business and make sure that you're compliant. Then the best thing to do is to get in touch with Padraig, take advantage of this free GAP analysis he's offered. And the best thing about it is there's no risk to you whatsoever. You simply get on call with Padraig, one of his team, explain what it is that you're doing. They're going to take care of all the heavy lifting and then they're going to produce a report which you can show to your colleagues, you can show to your board. And if it's really if it shows lots of GAPS, maybe you don't even want to show anyone. You want to keep it to yourself, but at least you will know where the gaps are and gives you an opportunity to go and do something about it. We're going to put in the description in the links, a link to QueryLayer so you can go there directly and take advantage. If you're listening on Tuesday, then make sure you get in there first because I'm not sure how many of these Padraig is going to be able to honour. And so you want to make sure that you get in there because I know he's going to have to cap it at something he just said, they haven't got the biggest team in the world and what they do is focus on quality. So if you want to be with a chance of getting that, then don't waste any more time. Pause the podcast right now. Let it play in the background. Go and click on the links which you can see right below you and sign yourself up and your company to take advantage of the offer of a GAP analysis. Okay, so Padraigf, coming back to the actual questions. One of the things you spoke about and I can see you've got so much experience in is actually that automation. What do you think is happening in this space when it comes to privacy automation over the next couple of years?

Padraig: 19:44

I think there's a number of trends that we're starting to see in this space. A focus on integration and interoperability. So like privacy programs are demanding that they can integrate seamlessly with their existing infrastructure and business processes. So I think there's going to be a focus on interoperability and this kind of seamless flow of work across systems. So the privacy team might be working with a particular solution, but they need to be able to translate that work to other teams in their native tools. So what I mean by this is that if you want to build collaboration across the organization, then you can't drive other teams to your solution. If they're using Jira, then you need to communicate with them in Jira. If they're using Slack, then you use Slack. But as a privacy team, you need to be able to orchestrate the work that needs to be done and communicate that work using the native tools within these teams. So interoperability, that's going to be key over the next few years. Last year in particular was a big year for this trend of like, shifting privacy operations left it's this concept of that companies that build software products and design services using code that they want to build privacy controls into the software development lifecycle. So similar to what we see in vulnerability scanning or security scanning and code bases, we're going to start to increasingly see privacy scanning within software development lifecycle flaws.

Jamal: 21:22

That makes absolute sense. One of the things that I really advocate for all of our mentees and privacy professionals that we’re helping to become world class leaders is if you want to be a world class, private professional, then you can't wait for people to come to you and meet you where you are with all of your credentials, with all of your knowledge. You have to go and meet people, your colleagues, your peers, your clients, your data subjects, your customers. You have to meet them where they are. And essentially you're saying the same thing but you're saying from a technology point of view, you can't wait for the teams or you can't force teams to come and meet you where you are with your tool and your solutions. You have to go and support them where they are with the tools they're using that are working for them and find a way of integrating with those. And this word interoperability you've been using is basically saying, look, it doesn't matter what you're using, we have a way of connecting with you and we can support you too.

Padraig: 22:13

Exactly. That's a great way of summarizing it Jamal.

Jamal: 22:16

Thank you Padraig. I do my best to make sure that I show all of my mentees that I listen, just the way I teach them to listen on the program as well. I think communication skills is a big part of that but now technology seems to be a lot of that talking and I think you're absolutely right. If we want to see real enhancements in privacy automation space and it is about going and saying, hey, we can meet you where you are, it doesn't matter what you're using, it doesn't matter how you're using it, we're going to find a way of coming and working with you. And I think that is actually going to be one of the crucial steps of great privacy programs compared to those more broker and ad hoc privacy programs is the ability to go and integrate with the rest of the business where they are without forcing them to come and make some changes. Because one of the biggest challenges I speak about with my colleagues or with my mentees is whenever we want to go and make a change to the business, you have to understand that operational disruption is a massive penalty and the moment you're asking for that change, you're asking the business to absorb that penalty. Unless you can actually show them the benefits of doing that, there's always going to be resistance and it's not about blocking, it's about making sure that we actually go towards that positive sum by getting buy in. But if we can minimize that disruption by having the interoperability then that's going to be a game changer and I'm really excited about what you're building and where the future is taking us.

Padraig: 23:36

Yeah, I think effect change, it's a key strength that a well performing privacy team need to have.

Jamal: 23:43

You've had an awesome career journey so far and it seems to keep continuing going from strength to strength. What advice would you give either to your younger self or to those privacy pros who are either looking to pivot their careers or actually looking to reignite those careers and maybe they've been doing something for a few years and now they can see the potential of what we're achieving through the academy. They're like, you know what, I want that too. I want that freedom. I want the fulfilment. I want that success. I want to be the go-to expert in the privacy space for my niche. What three bits of advice would you say is your top advice to them?

Padraig: 24:17

First, there are not as many areas as fast moving as privacy. Not only do we see the regulatory environment, the case rulings, and how they impact day to day privacy, but we've also had the tech side, right? And the data side. Every job requires someone to invest in staying abreast what's happening. But in privacy, it's on another level altogether. So part of our responsibility of privacy professionals is to make sure we're on top of that. So that needs to be part of your job every week, every day, to make sure that you have a good source of information for what's happening in our industry. Second would be specialization. I think very important that you have an understanding of privacy regulations, best practices. But we increasingly we see the importance of specialization. So what piece of expertise are you bringing to the field, to the market, that differentiates you from the peer? Like, what extra value are you adding? That could be a type of technology, could be an industry experience. When I hire, I'm always asking myself, what is this person bringing that we don't already have? And then my third piece would be around community and networking. So a good network is critical to success in any career. I think within privacy we have some great forms for that, such as IAPP conferences and different events. But you should also try to seek out smaller specialized communities where you can build deeper connections. So for an example, we have a small community of privacy practitioners, people who are building privacy programs day to day. And then within that we have monthly webinars where people talk about particular issues that they're having in the implementation of their privacy program. And these small kind of communities are great ways of building your peer network, building deeper relationships, and getting valuable feedback. So I would say when you think of networking, think about building your network, think about large events, but also find your small community, find your local niche community where you can build those deeper relationships.

Jamal: 26:35

These are super hot tips there Padraig, you are on fire today. You're going to have to stay behind and tell me what your morning breakfast routine is because I need whatever you have. So let me summarise what I’ve understood. So Padraig’s shared his three awesome super tips. And it's actually not just tips he's giving for the sake of it, but it's actually exactly what he looks when he's hiring privacy pros. So this is coming direct from the source. So this is going to be something that you want to pay attention to. And if you haven't got pen and paper, you should know every time you listen to a podcast, you need to have pen and paper because Padraig has just dropped some awesome gems. So he gave us three top pieces of advice for how you can really make your career jumpstart and if you've already jump started, how you can now take it to the next step and reignite it. So the top tip number one was, listen, privacy program, it's fast, it's moving, it's evolving. And it's not just the laws and the regulations that are evolving. And there's some kind of guidance coming out every other day from Europe, up from the US, from other parts of the world but technology is also evolving. So we need to stay aware. We need to stay relevant. We need to make sure we have our ears on the ground. So find a way of making sure that you can actually stay up to date and stay relevant. Twitter is a great way of doing that. There's lots of amazing Twitter threads. I'm not as active in that as I'd like to be yet, but look out for me, LinkedIn is a great source for that. You need to make sure you're following the right people. And also, every Wednesday on my LinkedIn profile, you can see that I post updates to help us all stay relevant. So make sure you follow up for that. Every Wednesday morning, I post industry updates, everything you need to know from across the globe. I give you the bite size, so you just need to go, and if you're more interested, you can follow the links and make it easy peasy for you. Also, you can join our newsletter where we share these updates in a lot more detail. Once a week, we're not going to try and sell you anything. We don't talk about anything else. Once a week, we just let you know everything you need to know. And at the bottom, we would plug in amazing bits from the podcast. So make sure you sign up for that, and we include the link for that here as well. So stay aware. Topic number one. Number two. Padraig said okay, so why you? What makes you different from everyone else? And the challenge I have when my mentees run the academy is they're so busy trying to fit in, but actually they should be doing the opposite. What they should be doing is being outstanding. And it's those outstanding people that magnetically attract opportunities to them. It's those outstanding people who can show the value they bring. So what Padraig is saying is, what is the additional value that I get from you that I'm not going to get from anyone else? What are you bringing to my team? Where is that additional value that I can't find of everyone else who's just got those basic IAPP certifications? What is it that you specialize in? What is your niche? And by finding your own niche or niche for American listeners, by finding what it is that you specialize in a way that intersects with privacy, not only are you showing how you're outstanding but you're showing that I can offer something to the business that nobody else can.

Jamal: 29:26

And one of the things we speak about when we're actually on the coaching is for you to get hired, you have to prove three things. You have to show what makes you unique, you have to show what makes you different, and you have to show what makes you superior. And what Padraig has just said in one kind of top tip takes all of that and just makes it easy peasy. So find your niche, find your specialization, and find what it is that makes you bring more value than any of your competitors or other people going for the role. And that's when you will get headhunted for those opportunities. If you're a consultant, you can pick and choose the clients you want to work with. You name your rate. They're not going to get this value anywhere else because you're a specialist. They're going to come to you. And I think Padraig, that's probably being the number one thing that's really helped me in my career when it comes to the consultancy, is finding our niche and speaking to those customers who really want that pragmatic, simple, easy peasy, without the complexity. And we do that better than anyone else. And that's what's really helped me get my brand out there. Get interviews with BBC, get on interviews with ITV, get on radio, being asked to speak at keynote events. And I think if you take nothing away from this, then just take that one thing is find something where you can specialize and go and do that and own that space. And then the third thing you said, which is actually when we look at our C Five methodology, the last thing we have, or the last C we have, is community. And I believe it's so important, just like Padraig, to have that environment around you of people. You can cross a safe space where everyone has got the same mindset, everybody wants to do well, where everyone is passionate about privacy and you're keeping each other updated, but not just that. Using your global experience, using your cultural experience, using your industry experience to come together to help each other solve those problems, stay up to date, have a look at something a different way, offer resources so you don't have to waste time. You can actually go, you can use it as a sounding board, you can offer advice and value. And we've got some great communities, so we have this thing called the Privacy Pros Network Padraig. So anyone that comes and joins our academy, you've had this WhatsApp group and essentially it's full of people from all over the world that have joined our programs. And all we do there is support each other. There are some people who will be in the same place where you are, so you grow together. There's some people that can be way ahead of you. You're going to learn from them. And there'll be other people who are not yet where you are, and you get to support them and by helping each other out, that is truly how we grow. And what unites us is this vision that we will have when we want every woman, every man, and every child on this planet to have freedom over the personal information wherever you go.

Jamal: 32:02

And we realized in order to fulfil this vision, our mission is to make sure that every organization that processes personal information does that in a way where they're doing it openly, honestly, and transparently. And your tool there really comes in and helps them automate some of that to make sure that everyone can actually enjoy the right. One of the things you mentioned there use cases was just responding to something like a subject access request. We can see how we can start using technology to enhance that. And one of the things we actually talk about in the forum is the tools that we can use. So when someone comes across a great tool, they're like, hey, I came across this tool, or someone is like, I'm looking for a solution for this. What do you think? And instead of having to go and do all of that research, you can actually go and speak to people who are actually using it, have been using it, and get their experiences so you don't have to go and pitch something that you're unsure about, and you can eliminate all of that risk. But you know what? Padraig just made an offer to anyone to say he's going to do a free GAP analysis on all of your ROPAs, so you don't even have to worry about those things go in there. The first thing I'm going to do Padraig after this is, get that link and share it with my community before this podcast even goes live. Sorry if you're listening to the podcast, guys, but I got to look after my community, right? And if you want to join the community, get in touch DM me on LinkedIn, email us whatever you need to do, get in touch. We're more than happy to help, and we'd love to see more people join our community. And then Padraig said, look, there's some great communities. You've got IAPP community. You can go to conferences, you can go on LinkedIn, you can go in all of these places, but you can also carve out your specialist niche community, and which is what we have at the Privacy Pros community. So everyone you've listened to on the podcast, everyone that inspires me and my students on the Accelerator program, we've got this platform on Signal, and that's where we really exchange the top level ideas and have really fascinating discussions and Padraig for one of the things I haven't shared with you yet. But we also want to thank you for coming and giving up your time and sharing these valuable gems on the podcast. I'm going to invite you to join that community and be amongst all of the other people you've seen on the podcast. Some people who have not yet been published and other people who are just inspirational in this space. And it's going to be a great place for you to learn, contribute, and also thrive in. So thank you for those three lessons. So guys, I've been doing a lot of talking and I went off tangent a little bit. Let me just sum up Padraig’s big top three tips. Number one, stay aware, be relevant, make sure you're up to date. Number two, make sure you find a specialization. Find your niche. What is it that you specialize in that brings added value that they can't get anywhere else? And number three, stay connected, find it, create an environment. Or go and join an environment where you've got like minded professionals solving problems that's going to help you stay up to date, support you, and you can also give back and support people because only when we give back and help others, they push us to the next level. Did I do you justice there, Padraig? Absolutely.

Padraig: 34:48

Jamal that was an amazing overview.

Jamal: 34:51

All right, so I've got one more question for you, Padraig, and it's an opportunity here for you to share. Can you share a story, your most memorable client story?

Padraig: 35:00

I'll share two short stories Jamal.

Jamal: 35:04

Padraig you're always overdelivering. If I ask you for one, you give me two. I ask you to give up your time for the podcast and you come bearing gifts. Where do we find more people like you?

Padraig: 35:18

That's what we're all about with QueryLayer. That was a shameless plug, Jamal. One of our early founding customers, and founding customers are really super important for a start-up because they can really influence the future direction that you take. We were very fortunate that one of our early founding customers was a data protection team at a tech company that were very heavy users of SAS. And yeah, they had quite a large, I suppose, data environment. And so they were struggling to build their source of truth for their data protection program. What was the scope of the challenge that they have? And they had spent months basically using combination of manual processes and conventional lead discovery to try build this data map. But all they were getting was kind of snapshots in time from the manual efforts and partially complete ones from e-discovery. I think working closely with them, we were able to build this kind of responsible data discovery engine and solution that focused on metadata and time to value. That's memorable for us because it was one of our early success stories and it also heavily influenced the direction that we took. I think on a more personal level, I worked on this smart home deployment with the Irish Health Service in Dublin and we worked on a smart home deployment for people with early onset dementia. And this was a project that was undertaken with the Irish Health Service, but the participants were at the very start of their journey with this condition. Like, for me, the real personal takeaway was the fragility and the sensitivity that they had about the data that we were collecting. And I think sometimes privacy can be very abstract. When I think about privacy on a personal level, it's maybe something to do with, like, photos of my kids, and that would probably be the strongest, let's say, emotional connection to privacy. But privacy really matters. And I think as an industry, as a collection, we need to remember that. But sometimes we get focused on the technical sides or the regulatory sides. But privacy is something deeply personal, and I think we're very lucky to work in an industry which can have such, yeah, I suppose, a personal impact on people. I think sometimes it's easy to forget that. But that privacy, it really does matter. I think we should all be proud to work in an industry or to work in an area that can have such an impact.

Jamal: 37:52

One of the things that I'm reminded of time and time again is when you impact somebody's right to privacy, that also starts impacting on some of the other rights. And that's why the right to privacy is so important. And thank you for sharing those two stories. The second one was particularly warming, is about how we can see that privacy touches everything. And people with early onset dementia, you got to work with the health service and just remind you about the value of what you're doing and why what you're doing is so important. And it reminds all of us, privacy pros why we do what we do and why we love doing what we love to do. It's because it's such a powerful thing, which is often easy to overlook, because you just get a little bit lost in the abstract of the technology. But actually, it's at the core of everything that we do and everything that we are. And that's why in Europe, we recognize it as a fundamental right. And we can see some of the atrocities that happen in other parts of the world. For example, the weak, our community in China, what happened in Nazi Germany, what's happening in other parts of the world where people had to flee from those countries because they didn't want to be spied on by the state. So privacy is so important, and Padraig just reminded us about why we get up every morning to do what we do, and that's what we do, and how it's so instrumental in helping the lives of many. Padraig, you've been an absolutely amazing guest. Now, if Jamilla was here, she would give me the opportunity to ask me one final question before we go. Someone extend the sentence to you. What question would you like to ask me?

Padraig: 39:15

You gave great insight into, I suppose, what are the early career challenges that you see amongst people who are trying to get into privacy? What would you say are some of the biggest barriers to people who are trying to get started in our industry?

Jamal: 39:33

I think the biggest barrier to people who are getting started is fear. It's fear of the unknown. They're not really sure what the role entails, are not really sure what the right certifications are, and they're not really sure what they need to demonstrate to get in. And a lot of people are like, look, I've been doing this for five years, six years, seven, eight years, ten years, and I'm actually quite comfortable, but I'm not getting the fulfilment, or I'm not getting that work life balance, or I'm not getting to do something that energizes me. It's just become very routine and I can't actually see where my career is going, and I'm looking for an industry where I can actually take my career even further. They actually don't want to lose what they have and start again. And this is where what you said earlier is so powerful about adding more value. You're not losing anything, you're bringing that value you already have, and you're adding privacy on top of it. So what happens sometimes is people will go and join some of these groups. And when we spoke about communities before, it's very important to make sure that you go into the group with the right mindset rather than the wrong mindset.

Jamal: 40:33

Because early on in my career, Patrick, I went and joined every, WhatsApp, Facebook, LinkedIn group I could find. And most of them had people who just wanted to get into privacy because it paid well. They didn't really care about understanding the hearts of the issue or why this was a human right and how it impacts on other things and all. It was like, oh, you know what, you can do this certification. You don't even do this certification. And here's some answers, here's some question dumps. And they had this really whole mindset, a really fixed mindset and a really scarcity mindset, that there is not enough roles out there and there's not enough opportunities, and just keep this stuff to yourself and just go and pass an exam. That's what you need. But it doesn't matter what exam you pass. It doesn't matter how you approach it, unless you actually care about what you do, unless you can show to the business people like Padraig who are hiring privacy pros, that you understand what you're doing, you have clarity and what you're doing, and you have the right attitude and activity, nothing else matters. So what I would say is my biggest top tip is get over the fear, punch fear in the face. Don't feel like you're going to have to start again, and don't feel like you're going to have to forget everything you've learned all this time. You already come into the table with that value. And now you're going to add private. And if you take Patrick's Tip, you're going to find a niche that you get super focused in. And then you have to add three things. You have to add your motivation for the role. You have to add your motivation to actually be able to demonstrate that you want to work for a particular company on a particular space. Why do you want to work in this space? So, for example, if Padraig was hiring, they want to know why someone is passionate about using technology to enhance privacy programs, or how we can help customers respect people's rights faster or respond to them faster. How we can make sure that businesses have the confidence they need using technology. There has to be a motivation where once you kind of jump over that hurdle or you've met that requirement, then you have to feel that you're actually competent in what you do. And when it comes to competency, a lot of people have this limiting mindset or this false belief that competency and experience are the same things.

Jamal: 42:32

And they say, well look, I can't go for these roles because I don't have experience. But that's not true. When someone says, hey, you don't have enough experience, they're not actually saying you haven't been a life long enough, or you haven't done this privacy role for long enough. What they're saying is, because I can't see any evidence that you've actually done this before or that you know how to do this, I don't believe you're competent in doing this. And therefore we're taking a risk. When you hire someone, we think you're a bad risk to take. We'd rather go with someone who can demonstrate they have done this, they know exactly what to do, and they're going to do a great job for us. So how do we overcome that barrier of experience? It's by getting those skills to show that you can operationalize that knowledge into practice and that you know exactly what you're required to do. You've got good experience or good knowledge of doing it, and you can go and help them too. And that's where our accelerator program really comes in, is we don't just focus on the theory. We focus on giving you those pragmatic and practical experience and tools that you can actually do this stuff so you can demonstrate that competence when you're going to be speaking to somebody like Padraig. And then the final challenge is actually the attitude, the person you are, what are you bringing to the table? Are you going to fit in with the rest of the team or are you going to be annoying or are you going to be difficult to work with? And that's the first thing you have to kind of help people understand, is how do you demonstrate you're going to be a great cultural fit? How do you demonstrate you're going to come and gel with the team, and you're going to actually add value to the team, and you're going to enrich the team rather than be a drain from the team and cause more problems and waste time and energy. And then they're going to have to replace you. And all of that comes from having the right mindset, having the right assumptions, to be an awesome privacy pro, to be an awesome privacy leader. And we go through all of this on the mindset program elements of the accelerator program. But my favourite assumption that I empower my mentees with Padraig is you have to come in believing that everyone is doing the best they can with the knowledge and resources available to them. And it's up to you, as the privacy pro, as a privacy leader, to then go and meet them where they are and empower them to see things differently, to do things better with kindness rather than, oh, you guys have no idea what you're doing. If you're doing that, you're not allowed to do that. They're not privacy pros. And when they come and ask you for stuff, they need subject matter experts in what they do. And there's no point regurgitating articles to them or reading out or rephrasing EDPB guidelines. It doesn't mean anything to them. Where you add the value is being able to take that and translate it to them in a language that they understand so they actually understand, oh, I now have clarity of what that means, and I'm very confident of what I need to know. And that also makes you look credible. The moment you start opening your mouth and start spouting legalese, people think it makes them look intelligent. It actually doesn't. It just says, I'm never going to get on with you. I have no idea what you’re talking about. I'm not going to bother coming to you, I'm going to try to figure out the answer somewhere else, or I'm just going to say, it's your problem kind of thing. I don't know if that answers your question. That's essentially what I have to say about that.

Padraig: 45:27

Excellent. Yeah, I think it does. I won't attempt to summarize it, but I think the point is well made.

Jamal: 45:34

Thank you, Padraig. It's been an absolute pleasure speaking with you. Thank you so much for sharing all of those gems on the Privacy Pros podcast and for that gift that you've offered to all of our listeners. I look forward to speaking with you again, Guys, make sure you go and check out the links, connect with Padraig on LinkedIn, make sure you go and get your privacy team that free gift is offered, and I'll see you on the podcast this time next week. Until then, peace be with you.

Outro: 46:00

If you enjoyed this episode, be sure to subscribe, like and share so you're notified when a new episode is released.

Outro: 46:07

Remember to join the Privacy Academy Facebook group where we answer your questions.

Outro: 46:13

Thank you so much for listening. I hope you're leaving with some great things that will add value on your journey as a world class privacy pro.

Outro: 46:20

Please leave us a four or five star review and if you'd like to appear on a future episode of our podcast or have a suggestion for a topic you'd like to hear more about, please send an email to team@kazient.co.uk

Outro: 46:34

Until next time, peace be with you.