The privacy profession

• DPO in the tower
• guardian of risk control and data security

• Compliance tower
• classic privacy compliance: documents, processes and mandatory Law 152-FZ measures around PD

• SDPT bridge
• secure data processing technologies let you use data without excess disclosure

• Users
• internal and external data users the system is built for

• Island of lean processing
• exactly as much data as the purpose needs

• Regulatory moat
• law, by-laws and regulators' positions surround the whole system

Context: by doctrinal periodisation, global compliance has passed three stages: meeting requirements, privacy by design and competing frameworks. The Russian model is closer to the first: accountability via the list of measures in Art. 18.1 of Law 152-FZ

Internal parties

• HR
• IT
• Legal
• Compliance

External parties

• Regulators
• Clients

• Suppliers
• Subjects

Objects of work

• People
• Processes
• Systems

• Party
• What the privacy pro gives

• Management
• removes uncertainty on requirements and risks, is the interface with the regulator and the entry point in a crisis

• Business
• turns requirements into working rules, cuts compliance costs, reveals hidden scaling risks

• Adjacent functions
• a specialist competence centre that takes the load off them

• Subjects
• transparent processing, lower risk of rights violations

• Regulator
• the role has no standalone value but eases interaction

Practice: the role's value looks different to each party, and the language of the conversation depends on it: risks for management, cost and speed for business, transparency for subjects

• 1
• Why the role

incident, inspection, more requests, auditor advice: the cause shapes expectations

• 2
• Party map

position, PD knowledge, weight in decisions and preferred channel of each key person

• 3
• Inventory

documents, unwritten rules, process traces, past incidents, inspections and disputes

• 4
• Three requirement layers

law, best practices and ISO and NIST frameworks, the company's own decisions

• 5
• Integration points

contracts, access provisioning, IS checks, architecture committee, communications, reporting

• 6
• Quick wins

website audit, incident response plan, a readable policy, a basic record of processing

Metric: early success is measured by closing the most significant risks, not by the number of processes covered and employees trained

Role position

Advises, does not decide

Habit is second nature

care for the employer's usual way of doing business

Risk-based approach

treating privacy risks in line with stakeholders' risk appetite

Do no harm

privacy risks are not reduced by increasing other risks

Active engagement

risk treatment proposals are discussed with stakeholders

Practical results

final materials are geared to use in day-to-day operations

93%

Consultations

on data protection issues, in-house DPOs 97%

89%

Notices

on privacy, in-house DPOs 92%

88%

Training

on data protection, in-house DPOs 94%

79%

Impact assessment

on privacy and data protection

• Task
• Share
• Task
• Share

• Managing privacy programmes
• 79%
• Creating and updating the PD processing record
• 73%

• Investigating leak incidents
• 78%
• Organisation's legitimate interest assessment
• 73%

• Processing agreements (DPA) and contracts
• 78%
• Replies to data subject requests
• 72%

• Privacy violation complaints
• 78%
• Oversight of consent management
• 64%

• Reporting to management and auditors
• 76%
• Tracking PD transfers to third countries
• 64%

• PD retention policy
• 74%
• Supplier risk assessment
• 63%

For Russia

A formal role now costs more

a responsible person is mandatory for any legal-entity operator; from 11.12.2024 Art. 272.1 Criminal Code and from 30.05.2025 turnover fines under Art. 13.11 CAO apply

a paper appointment is no longer a cheap decision

turnover fine size is tied to IS spending, Art. 4.1(3.4-2) of the CAO

• 1
• Segmentation and specialisation

the role splits into tracks of lawyer, engineer, analyst and programme manager. Groups of companies form a DPO network across group, subgroup and company levels

• 2
• Not just compliance but design thinking

requirements are built into processes, products and systems at design stage: changing a design costs a discussion, a launched product costs a halt

• 3
• Focus on non-legal skills

the role needs three knowledge domains: law, business processes and how information systems work. Appointing one HR officer leaves two domains uncovered

• 4
• Community growth

the IAPP 2025-26 report covers AI governance professionals for the first time; 77% of over 1,600 respondents from 60 countries hold IAPP certification

Privacy lead's department

• Function
• Total
• US
• EU
• UK

• Legal
• 49%
• 58%
• 47%
• 42%

• Regulatory compliance
• 15%
• 13%
• 14%
• 18%

• Information security
• 6%
• 8%
• 6%
• 5%

• IT
• 6%
• 5%
• 3%
• 6%

• Corporate ethics
• 4%
• 5%
• 4%
• 4%

• Other
• 13%
• 7%
• 17%
• 19%

Median salary 2025, $k

• Area
• Median

• Technical AI governance roles in tech
• 221,0

• Legal and compliance roles in tech
• 205,0

• Privacy and AI governance together
• 169,7

• AI governance only
• 151,8

• Privacy only
• 123,0

Trend: those combining privacy and AI governance have a median $46.7k higher than those in privacy only. 2025 survey: over 1,600 respondents from 60+ countries

Step 1

Data protection

win client trust and move towards accountability

• 1
• data protection management

• 2
• IT risk management

• 3
• security breach management

• 4
• stakeholder management

• 5
• audit and compliance

• 6
• data management

Step 2

Data-driven innovation

use data to create new or improved goods and services

• 1
• data ethics

• 2
• data sharing

• 3
• design thinking skills

Counterargument: the claim that data protection slows innovation is not borne out by comparative experience: China tightened its protection regime while becoming an AI development leader

• Skill
• Gist

• Data protection management
• PD protection policies and procedures per applicable law and best practices

• IT risk management
• forecasting and assessing IT risks to operations and profit, strategies to reduce PD processing risks

• Security breach management
• detecting incidents and leaks, assessing circumstances and consequences, measures and communication with those concerned

• Stakeholder management
• stakeholder expectations and needs, given the organisation's requirements and goals

• Audit and compliance
• external and internal monitoring and control, including whistleblowing and internal investigations

• Data management
• PD processing rules at all life cycle stages and advice in complex and ambiguous contexts

• Data ethics
• ethical principles in designing PD processing, see Section 02

• Data sharing
• assessing PD value for competitive advantage and organisational goals

• Design thinking
• a path from defining the problem, research and ideas to implementation, involving stakeholders

Everyone designs who devises actions to turn an existing situation into a preferred one

Herbert Simon, The Sciences of the Artificial, the basis of design thinking

Data ethics

• 1
• WFA, Data Ethics: The Rise of Morality in Technology, June 2020

• 2
• ethics answers where the law is evaluative

Business processes

• 1
• requirements are built into processes, products and systems at design stage

• 2
• the privacy pro offers options, does not prohibit

Architect

vision, mission, values and clarity

Planner

short- and long-term plans

Executor

makes sure it all happens

Conductor

unites people's efforts and opens opportunities

Teacher

mentor and coach for teams

Guardian

serves others before self

Innovator

generates ideas and creates conditions for innovation

Expert

understands people, business and context, weaves in culture and results

Thinker

evaluates, analyses and thinks critically

For the privacy office: Privacy Program Management

• impact and risk assessments
• consent management

• data map
• subject requests

• incident response
• legislation monitoring

website scanning

Company-wide: Enterprise Privacy Management

• activity monitoring
• data discovery

de-identification and pseudonymisation

corporate communications

The tool processes PD itself

Three vendor questions

where is my data: instruction under Art. 6(3), localisation under Art. 18(5), CBT under Art. 12

what is this based on: traceable to a provision, Roskomnadzor position, case law

how do I take it all and leave: export formats, return and destruction of data

Deal-breaker: processing instruction and localisation are deal-breakers: without them the tool fails selection whatever its score. Tool selection is covered in detail in Section 09

01

The role is mandatory, its content is not

every legal-entity operator needs one, but the three functions in Art. 22.1(4) of Law 152-FZ are a floor, not a ceiling

02

Independence is built by practice

152-FZ has no status guarantees like the GDPR DPO's; offset by reporting to the top person, metrics, the right to demand

03

Advises, does not decide

the privacy pro guides through options and risks; the process owner decides and takes the risk

04

Interdisciplinarity

law, business processes and information systems plus non-legal skills and design thinking

05

Functions define the person's requirements

the law sets no qualification; Roskomnadzor points to the powers in Art. 22.1(4) of Law 152-FZ (letter of 03.05.2024 No. 08-142784)

06

Metrics prove value

the role is justified by closed risks and measurable indicators, not the volume of work done