Track record
Outcomes
Programs are easy to describe and hard to run. Here is what the work actually produced: the numbers first, then the projects behind them.
~70
Privacy and security assessments per year
At The Globe and Mail, including about 20 full Privacy Impact Assessments.
~200
Vendors and assets in the data inventory
Rebuilt from about 60 stale entries, reaching 90%+ attribute completeness.
~20
AI tools through the intake process
A tiered approval workflow built with Power Automate and a POC review committee.
~90/mo
Deletion requests at peak
Access and erasure workflows built to hold 30-day regulatory deadlines.
1 month
To sole enterprise OneTrust admin
At TELUS, after the previous admin left; built Law 25 questionnaires and automations still in use.
450+
Stakeholders trained
Across privacy, data governance, and AI tools, from analysts to executives.
In practice
Three projects, up close
Dayforce HR integration PIA
The most complex assessment at The Globe and Mail: a sensitive HR data migration touching HR, finance, and IT, with legacy systems and manual processes being replaced mid-flight. Led the assessment end to end, coordinating data flows, risk findings, and mitigations across all three teams.
Data inventory rebuild
Inherited a vendor and asset inventory of about 60 stale entries. Rebuilt it to roughly 200 vendors and assets at 90%+ attribute completeness, turning it into the single source the privacy program actually runs on.
AI intake and governance
Built the AI intake form in Power Automate, an emerging-AI governance framework, and a POC review committee with legal, privacy, and IT. About 20 AI tools have moved through the tiered approval process since.
Writing
Publications
100+ articles on Canadian privacy law, AI governance, and data protection, published on Insights and in both English and French. The privacy glossary covers 275 defined terms, and the Privacy Pulse tracks enforcement and regulatory news weekly.
Speaking
Workshops, not slideware
I run practitioner-led sessions on privacy programs, Law 25 readiness, and AI governance for teams that want working knowledge, not slideware. If your team or event needs one, start with the contact form and tell me what you are trying to fix.
Want these outcomes in your organization?
Project, fractional, or roadmap engagements, scoped around the results above.