))
The Critical Friend: How to Build Privacy Programs That Actually Work with Sean Milford
Manage episode 488158098 series 3644869
Content provided by Kellie Du Preez and Danie Strachan. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Kellie Du Preez and Danie Strachan or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.
What does it actually take to run an effective privacy program inside a fast-moving, resource-strapped business? In this episode of Privacy in Practice, Sean Milford, Global Head of Data Privacy at Syndigo, shares a playbook for turning privacy theory into operational results. If you're managing privacy across teams, tools, and time zones, this episode is a masterclass in making it work.
What You'll Learn:
- Why privacy is a team sport and how to lead across law, marketing, and tech
- What privacy engineering looks like beyond theory
- How to build vendor programs that scale and stick
- Why privacy ops succeed (or fail) at the department level
- How to use maturity models to prioritize risk
- When to use DPF, SCCs, or BCRs and why backups matter
- How to run privacy programs in remote or global teams
- What it means to be a “critical friend” to the business
- Why centralized “Base Camp” docs make compliance scalable
- And so much more!
Sean Milford is the Global Head of Data Privacy at Syndigo, where he leads global privacy initiatives across multiple industries. With over 20 years of experience in privacy, cybersecurity, and compliance, Sean has worked for major global brands including Visa, PwC, Dell Technologies, and HSBC. He is also completing an advanced master’s in Privacy, Cybersecurity, and Data Management at Maastricht University. Known for his ability to translate between legal, technical, and business audiences, Sean specializes in building operationally grounded privacy programs that scale.
For those seeking to strengthen their understanding of privacy program design and implementation, Sean Milford recommends the following resources:
- “The Checklist Manifesto” by Atul Gawande
- “Privacy Design Strategies: The Little Blue Book” by Jaap-Henk Hoepman
- “Strategic Privacy by Design” by R. Jason Cronk
- “Design Assurance Standard v1.0” by the Institute of Operational Privacy Design (IOPD)
Connect with Sean Milford here: LinkedIn
Connect with Kellie du Preez here: LinkedIn
Connect with Danie Strachan here: LinkedIn
Follow VeraSafe here: LinkedIn
If this episode gave you a new way to think about privacy in practice, we’d love it if you subscribed, rated, and left a quick review. It helps us keep bringing practical insights to privacy pros like you.
Episode Highlights:
[00:06:31] From Privacy by Design to Privacy Engineering That Works
"Privacy by design" might sound good in theory, but what does it look like in practice? Sean pulls back the curtain on privacy engineering and explains how teams can go beyond policy to actually embed privacy into technical architecture. He shares how his background in software development helps him ask the right questions about data flow, system boundaries, and access control, so that privacy becomes a functional requirement, not just a legal obligation. Sean argues that privacy teams don’t need to build everything from scratch; instead, they should integrate privacy into existing engineering and operations frameworks. This means speaking the language of developers, mapping privacy goals to security controls, and packaging requirements as design-ready inputs. The result? Privacy programs that are built to scale and designed to last.
[00:15:16] Privacy Is a Team Sport And Needs a Game Plan
One of the biggest misconceptions in privacy is that it lives with the legal team. Sean challenges that idea and emphasizes why privacy must be co-owned across legal, engineering, marketing, and business operations. He explains that privacy success often hinges on alignment, not expertise, because no single function can fully see or manage data risks. Using examples from his global roles, Sean shares how to “translate” privacy across disciplines so it becomes relevant and actionable to each stakeholder group. For instance, you’ll need different narratives when working with marketing on data minimization vs. engineers on system design. His tip? Think of the privacy team as a “critical friend” to the business: supportive, honest, and embedded enough to influence decisions in real time.
[00:24:07] Vendor Management Without the Burnout
Vendor risk is one of privacy’s most daunting tasks, but Sean offers a refreshingly pragmatic framework for managing it. He outlines how to tier vendors based on business value and data sensitivity, and explains how to align contract terms, like SCCs, DPF, or audit rights, with real leverage. The episode dives deep into what sustainable vendor management looks like in practice: integrating privacy reviews into existing supply chain workflows, standardizing assessments, and being honest about where you can’t negotiate. Sean also touches on how to maintain accountability post-onboarding, especially in global environments where ongoing audits can be challenging. The key lesson? A repeatable, right-sized approach will keep you compliant without consuming your entire privacy function.
[00:38:18] Scaling Privacy with Lean Teams and Frameworks That Stick
What if you're a privacy team of one or none? Sean tackles the challenge of building impact with limited resources, sharing a two-pronged strategy: manage the day-to-day (“run the business”) while carving out time for strategic improvements (“change the business”). He explains how capability maturity models and frameworks like Nymity or the ICO Accountability Framework help prioritize what matters most, rather than chasing perfection in every domain. Sean also introduces the concept of a “Base Camp”, a central, accessible hub where teams can get privacy answers fast, reducing noise and confusion. He shares practical tips for embedding privacy in distributed teams, including pre-built Jira templates, checklists, and cross-functional playbooks. For resourceful teams working across time zones, this is a blueprint for doing more with less, without compromising on quality or clarity.
[00:46:55] Turning Policy into Practice: Why Privacy Ops Lives (or Dies) at the Department Level
You can have a gold-standard privacy policy, but it’s worthless if no one in the organization knows how to use it. Sean explains how successful privacy operations rely on decentralization, not in ownership, but in execution. By requiring each business unit to develop its own operating procedures based on core policy, companies embed accountability where it counts. He also emphasizes the importance of tools and playbooks, like linking Jira tickets to privacy workflows or using checklists that guide users through compliant actions. It’s not just about having a policy; it’s about integrating that policy into the systems and rhythms of real teams. The lesson: privacy doesn’t live in the binder; it lives in the daily decisions made by customer support, engineers, marketers, and product managers.
[00:51:08] Working With External Advisors: The ‘Critical Friend’ Mindset
Engaging outside consultants and legal partners isn’t just about outsourcing expertise; it’s about building long-term collaboration that can flex with evolving needs. Sean shares why the best external advisors act like “critical friends”, professionals who offer blunt honesty when needed, but remain embedded in your business context. He outlines what makes these relationships work: mutual trust, shared tools (like access to internal frameworks or SharePoint hubs), and a human connection that extends beyond contracts. Especially in remote-first or high-pressure environments, these external partnerships can provide stability, strategic insight, and backup when bandwidth is low. The takeaway? Your privacy partners should help you build, not just review, your program.
Episode Resources:
7 episodes
Share
