Ever wondered what separates good Privacy Pros from EXCEPTIONAL ones?

In this episode of the Privacy Pros Podcast, Jamal Ahmed hosts Dr. Valerie Lyons, a seasoned privacy leader and author of the Privacy Leader Compass.

They discuss:

• Transitioning from cybersecurity to privacy
• The key differences between good and exceptional privacy professionals
• How to balance technical skills, business acumen and soft skills
• Qualities that allow Privacy Pros to create maximum impact

This is a must listen episode for anyone who wants to understand how to turn adversity into strength.

Dr. Lyons is author of the ‘The Privacy Leader Compass’, and leading authority on privacy as a CSR and ESG.

Included in the ‘Top 100 Women in Cybersecurity in Europe’, Dr. Lyons is an accomplished and driven cybersecurity and privacy leadership expert. Her career spans over 30 years - working in both cybersecurity and privacy teams. She has worked for several global organisations, such as IBM, KPMG, and ABB, and served as Head of Information Security Risk in KBC Bank for almost 15 years.

Dr. Lyons is director and Chief Operations Officer in BH Consulting since 2015. She has an in-depth knowledge of European data protection law and practices, and frequently presents at renowned international security and privacy conferences (such as RSA, COSAC, ISACA and CPDP). She has also lectured in Dublin City University on Privacy, Cybersecurity and Digital Ethics. In 2022, Dr Lyons was awarded a PhD in Information Privacy for her research into Privacy as a CSR. She also holds a Masters in Leadership, along with a post-graduate diploma in Executive Coaching. She is a certified CISSP for almost 25 years, a CDPSE for four years, and is a member of the Institute of Directors in Ireland.

Follow Jamal on LinkedIn: https://www.linkedin.com/in/kmjahmed/

Follow Dr. Valerie on LinkedIn: https://www.linkedin.com/in/valerielyons-privsec/

Ready to become a World Class Privacy Expert? Book your call to join the World's Leading Privacy Program

You need to be able to say, I have passion for this. I worked in cybersecurity for 25 years. I never had passion for it. When I met privacy, it was head over heels, love at first sight. I was there. And so it's what are you deeply passionate about? You cannot have impact without passion.

Are you ready to know what you don't know about Privacy Pros? Then you're in the right place. Welcome to the Privacy Pros Academy podcast by Kazient Privacy Experts. The podcast to launch, progress and excel your career as a Privacy Pro. Hear about the latest news and developments. Discover fascinating insights from leading global privacy professionals.

And hear real stories and top tips from the people who've been where you want to get to. We've trained people in over 137 countries and countries. So whether you're thinking about starting a career in data privacy. Or you're an experienced professional. This is the podcast for you.

Hello and welcome to another episode of the Privacy Pros podcast. Today I'm joined by a seasoned privacy leader who's earned a stellar reputation in the field And we're going to dive deep into what it takes to be a truly exceptional Data protection officer or a privacy professional. So in this podcast, you're going to get insights about the skills that separate the truly impactful privacy pros from the rest, what to focus on if you're aiming for senior leadership position in privacy and how you too can start laying a strong foundation for your career, even if you're thinking about just entering the industry or you're in your early stages. So stay through to the end. This conversation is going to pack with actionable insights just like every other episode. I'm your host Jamal Ahmed, award winning global privacy expert and founder of the privacy pros academy and recently best selling author of the Easy peasy guide to the GDPR.

Today we're joined by Dr. Valerie Lyons. She's the author of the Privacy Leader Compass and Leading Authority on Privacy as a CSR and ESG. Included in the top 100 women in cybersecurity in Europe, Dr. Lyons is an accomplished and driven cybersecurity and privacy leadership expert. Her career spans over 30 years working in both cybersecurity and privacy teams. She's worked for several global organizations including I-P-M-K-P-M-G, and A BB, and served as head of information security risk in KBC Bank for almost 15 years. She's a director and chief operations officer in BH Consulting since 2015, and and frequently represents at renowned international security and privacy conferences, such as RSA, COSAC, ISACA, and CPDP. She's also lectured in Dublin City University on privacy, cybersecurity, and digital ethics. And in 2022, she was awarded a PhD in information privacy for her research into privacy as a CSR. She also holds a master's in leadership along with a postgraduate diploma in executive coaching. She's certified CSSP for almost 25 years, CDPSC for the last four years, and is a member of the Institute of Directors in Ireland. Welcome to the Privacy Pros Podcast, Dr. Valerie.

Thank you so much, Jamal. It's great to be here.

It's such an honour and a privilege to have you. And I know we were just talking about how we've missed so many opportunities to see each other at events. And if I was to catch you, the first question I would ask you is what is your favourite way to spend your free time?

Oh my God. Actually I have different ways. I'm not so good at golf but I do like to play and I'm an advanced Tai Chi instructor. I spent my Saturday mornings for the last decade have been spent doing Tai Chi. And I like to run, I like to swim. I'm very social. So the minute I get a chance to meet friends, I'll go straight out there and catch up with friends. And I have two teenagers now. So they keep me very busy in the evening.

I'm sure they do. I've got my hands full with a two year old toddler

It's a sweet age though.

Yes, yes but when she's clawing at my face, I'm not so sure. But let's get on to privacy. So you've established yourself as a leading authority in the industry. Wherever I go, you're there. You're either on the stage, you're on a panel. From your experience in managing privacy teams, what's the key differences that elevate someone from being a good privacy professional to somebody who is exceptional.

I call it the good to great phenomenon, if you want to call it that. I don't know if you know the book from good to great. It's a very age old book, a management book. So I leveraged that in the privacy leader compass. We sought to find a sort of a good to great structure that we could use. Look, DPOs, privacy leaders, CPOs, they've got to know the legislation. There's a sort of a foundation that's a bare minimum. You must know the legislation and there's no point in me listing legislation because every jurisdiction is going to be different. But obviously if you're in Europe, you're going to need to know a patchwork of legislation now because privacy isn't just in the one. It used to be, but now it's everywhere. You know, it's e privacy, it's NIST 2, it's DORA, it's AI regulation, it's everywhere. There's snippets of it in so many pieces of legislation. So you've got to understand your state requirements, but you've also got to understand industry requirements for the industry that you're in.

So for instance, in healthcare, you'll have clinical research acts and a whole host of other different types of legislation. But then we also have business skills. And I divide in the privacy leader compass, those skills that the privacy leader should have into three domains. The first being the technical skills and one of those technical skills is project management. It's a very important technical skill that I think that we cannot operate without and I would recruit a project manager before I would recruit a lawyer. Not saying there's anything wrong with a lawyer, but a project manager can learn the subject matter expertise to be a DPO. I cannot teach project management so well. So I recruit project managers very readily and I'm not a great project manager myself, so I'll always want to have that in my team. And part of it is recognising as a privacy leader, where your own strengths and weaknesses are.

The second piece is the business skills and the business skills are understanding things like risk assessment. What is the risk appetite in the organization? What's the strategy for the organization and how does privacy fit into that strategy? How is the culture of the organization structured? What's the political agenda in each of the different silos? What's the materiality of each of the stakeholders within the organization? So a vast array of different business skills are required there. And then the thing that knits them all together is the softer skills, and they're actually the most important and probably the most difficult to learn.

And the softer skills, emotional intelligence is up there at the top but beyond that, you've got executive presence, you've got communication skills, you've got your report writing skills, presentation skills. They're all related to communication. Conflict management skills. Your leadership skills.

So there's a whole array of soft skills in there that we tend to neglect, we're very focused on, have you got your CDPSE or have you CIPPE or have you CIPP? We're very focused on industry certifications that tell us we have the technical skills. But we're not so focused on those other elements that tell us that we actually have the leadership skills and the leadership capacity, but not everybody needs them.

So every DPO and every privacy leader needs to look at their own structure. They may be a singular DPO as it's often the case, and they mightn't even be a DPO full time. They may be doing another role and doing DPO part time. So everybody has to look at what it is they need, because they may not need the drill down in each of those three pillars, but they may be leading privacy in a large team or across a number of silos, and they will need those additional special skills that take them from good to great.

That's fascinating. Not surprising, but fascinating at the same time, because I often speak about stacking skills, and what you've described there is there is no one single skill that's actually more important than the others, but it's actually adding more value to what you bring to the table and stacking on those skills. And so what I'm taking away from what you're saying there is look, the most important thing is subject matter expertise, and when we talk about subject matter expertise, because we're dealing with privacy laws, data protection laws, you need to know your laws, and you really need to know how that's different in each of the jurisdictions in which you're operating. And if you find yourself in a regulated industry, then you also need to know and understand and appreciate how those laws work enhanced or how those specific industry regulations work and what you can do what you can't do and where the lines are.

And then you mentioned all of the soft skills that I love to teach at the Privacy Pros Academy too. So we talk about emotional intelligence, and I don't think in business school, in these management courses, they stress the importance of understanding that at the day, you're dealing with people and people are emotional beings. And so having that emotional intelligence, being able to empathise with people being able to understand them, make them feel understood so you can lead, persuade and influence them towards where you need them to get to go to is going to be very, very difficult unless you understand, at some level, the emotional intelligence that goes into that. And also just the ability to be a good colleague and actually connect with people and make sure that they understand what your role is, but you also appreciate where they fit in. So you can actually have a community of people around you in whichever environment you find yourself in. So you all work towards the same common objective and goals.

And without those skills, you're just average and mediocre. But when you start stacking one of those skills, you find that that's what makes the exceptional privacy professionals and that separates them from the ones. And those are the ones that get headhunted. Those are the ones that their reputation actually precedes them because they bring immense value to the table and the message that I want to reinforce here is it doesn't matter how many of those skills you have or don't have right now, what you should identify, as Dr. Valerie said, is what strengths you have and what you need to complement.

And you can complement that in one of two ways. If you're in a leadership position, you can actually hire that in, but if you're not, and if you actually want to become a world class professional, then pick one of those skills and start focusing on that. Have a plan in place. Once you've got that to a really good level, then adopt a new skill that you're going to do and find the habits and the books and the coaches and the mentors that's going to help you to really develop those and demonstrate that you are now somebody who is super valuable to any organization. Does that sound about right? Have I done justice to your insights here?

I think it's great. And I like the idea of stacking. Stacking is a great idea. As I said, not everybody is going to be leading. They may just be leading the function rather than the people. In the Privacy Leader Compass, I make recommendations for different tools that I've encountered over the years and I've covered in my master's, in the leadership program I've applied into the workplace on trying to identify those missing skills. What are the skill set that this team are missing and who's good at what? And there's a great, tool called Belbin's team roles, which will analyse if you just apply it, who has key strengths in different areas. We have some people who we know are great at ticking boxes. They're the people who do the project management, and they just tick boxes. And we have some ideas, people, and they're very creative. And so different people have different strengths that they bring to the team. And it's important we recognize that just because somebody can't do what we can do, they actually might be able to do something else even better than we can. And it's important for us as leaders to find out what that is and to recognize what they bring to the table as well.

I'm a big fan of that because when you hire the similar skills or the similar skill sets and what you have is compatibility, but we don't want compatibility. What we want is somebody that completes the missing skills because we're not great at everything. No one person is great at everything. So what you'll find now is what is your zone of genius? What are you brilliant at? Or what are different team members brilliant at? Where are the gaps? And hire in or upscale people to actually start covering those gaps. Then you get that well rounded team. And when you've got a well rounded team, you can just go on and on and on, and you actually achieve some great things.

On that note, in your experience, what qualities, truly allow somebody to stand out and create maximum positive impact. You're someone that's had great impact in your career. Every time I see you speak, every time I see you publish a book, every time I see you do something on LinkedIn, there's always huge impact behind that. So what I want to understand is What are the qualities that really allow us or really allow you to have a powerful impact?

I think there's a number of different qualities. A huge one is humility. People say, well, how does humility align with trying to promote your brand? And trying to promote what it is you're doing and what it is your organization is doing and what it is you're doing for your team, trying to promote that. But at the same time, retaining humility. In the good to great leadership philosophy, it's so important to remain a humble leader. And I think that that is so true. I also often promote the book called The Art of Tooting Your Own Horn. It's a great book. It's about promoting what it is your organization is doing, what it is your team is doing, or what it is you do in a way that retains humility. We do what we do for a reason. I know, for instance, Jamal, you're very active in promoting that we as a community, we're advocates, we're fighting for something, we're trying to achieve a greater result at the end for data subjects.

That's why we do what we do. And that's important for individuals to remember that that's what it's about. It's not about just a career. It's actually about something more meaningful in my view. So we have to keep that in mind. But in Good to Great, the three key factors that he mentions about Maximizing your impact or maximizing an organization's impact is it's like a Venn diagram. One is, and you just mentioned it actually just there earlier is what is it you can be the best in the world at? What is that? Is that privacy? Can you be the best in the world at it? It requires certain skills. Do you have those skills? And you need a bit of passion. You need to have some level of passion there. It's so important in terms of impact. If you're not passionate about it, the impact is very hard to communicate. You need to be able to say, I have passion for this. I worked in cybersecurity for 25 years. Jamal. I never had passion for it. It was a means to an end, it paid the mortgage and that's no reflection on people who work in cybersecurity, but I never felt passionate about it.

When I met privacy, it was head over heels, love at first sight. I was there. And so it's what are you deeply passionate about? You cannot have impact without passion. And there is another piece, which is an important piece to recognize is you're not going to do it for free. An organization or an individual doesn't exist for free. Can you make it economically viable? That's a very important question you've got to ask about your impact. Does your work have an economic impact? It needs to have an economic impact individually or organizationally. You have to have an impact. And so there are three pillars that we need to explore if we want to know about how we best develop that impact piece.

But right in the centre of that is reputation. It is about building reputation, building your brand, building your organization's brand. It depends on whether you're about your organization or whether you're about an individual because you can be working for yourself and then the same, your organization and your individual achievements are one in the same because you're working for yourself.

An interesting side quote I heard recently when you work for yourself, you work for a tyrant. And so I thought that was interesting, but that people who work for themselves and there's an awful lot of DPOs work for themselves. They are their own organization. Whereas people working, leading teams are working for an organization, so they're slightly different objectives, they don't necessarily align.

Fascinating. Now, moving on from that, if you could give a piece of advice to your younger self or an experienced privacy professional who is, ambitious and they're seeking a senior leadership position, what would that be?

Depends on where they are, how much experience they have, like there's a whole series of questions we'd need to be asking along with those recommendations. But I would say, and it's just my own bias, I suppose and that is keep on learning. Just absolutely keep on learning. particularly as a woman, be the best qualified in the room. And that way you remove bias. That if somebody is going to get the job ahead of you, it's unlikely if you're the best qualified, so be the best qualified in the room. Much of what drove me to do a master's and then to do a PhD was to be the best qualified. So there are industry certifications, do as many of those as you can to be sure that you can demonstrate to a potential role that you are in fact qualified from the industry's perspective. So if you look at those three pillars, how are you identifying?

To a prospective employer that you actually are competent in each of those three pillars in the business pillar than the technical skills and then the soft skills. How are you demonstrating your competence?

I say to people, you should have an undergrad that is technical somehow. experience that is business and then a master's that's management leadership, something like that, that says there's my third.

That gives us our three pillars and elevates you at the kind of candidateship element. But also my own experience, and it depends on an individual, is that as a single parent, because I was widowed with young children, as a single parent. I sought money that was the key driver for a lot of the roles that I took was that money was better.

And then when my husband died, I had to change that because I needed to make decisions about bringing up children. Do I hire a nanny or do I bring them up myself? So I chose to bring them up myself for a period of time because I felt that they would have been through too much. And so that decision actually allowed me. To go choose a role, which is the role I'm in now that wasn't based solely on money. It was just based on the fact that they would allow me to work from home and would allow me to work part time and enable me to do PhD. So that was the reasoning behind that choice. And then that company grew and grew and grew.

And now I find myself in a role that I find fulfilling, it's not always about the money. So I would say to people there's a balance to be had between going for the big money and yet going for something that's fulfilling, drives you. That makes you wake up on a Monday morning and say, I really want to do X, Y, Z today, because that's how I wake now on a Monday is I can't wait to start working.

And I never had that before I moved into privacy. And so I cannot put a price on that Monday morning feeling. And I would say to people, think about that. And it's easy for me now to say to people, think about that price. When my kids are grown and I don't have the big mortgage anymore when I reflect back, I think I could have made some better choices in terms of balance. So I would say that's a key piece of advice I'd give to anybody is think balance, think fulfilment, joy, Monday morning and money.

That's super insightful, super insightful, and I'm sorry to hear about your, husband must have been

Best decision

Be a single mother dealing with the bereavement, having to balance income and making sure you provide for them, but making sure they get the nurture that they need about whether you get a nanny and yourself. And I'm happy to hear that you've made the choices that meant something for you, you found how to balance your vocation with that. And look at you now. All right.

Best decision ever. But I would have said, I don't know what I'm doing here. I don't know if this is the right decision, but retrospectively looking back, it was the best decision I ever made. And there was a lot of people said to me at the time, I think this is a really bad decision. You're stepping back from your cyber career, which I was, but I was stepping into a career that I didn't know I would love so much. And that's essentially what happened. So it was an accidental success.

I'm happy. So happy to hear that. And you also mentioned the price of waking up with that feeling on Monday morning, and this is one of the reasons I was like, I need to get away from compliance, case handling type of roles in the financial services because forget Monday morning, every morning, Monday morning was like, do I fall in sick? Am I feeling okay? I think I've got a bit of a headache or am I just saying that because I can't be bothered. This is what happened.

There comes a point where the money is no longer relevant because nothing is worth the price of having to go and be mind numb. Go and do something that you don't enjoy doing, be in a toxic environment that you don't actually particularly like and it's not healthy for you. Because all of that manifests itself in other ways, whether it's through mental health or physical health, and the cost of that is never worth it. Because all of the other things you can get back, but your health, that is the table that everything sits on. Your career, your family, your activities, your money, your wealth, your properties, all of that, everything sits on the table of health. If you take the table away. That's it. It's over. It's game over. And so I think people really underestimate the cost that they're paying for staying in unfulfilling roles without actually doing anything about getting away from it. So I want to thank you for highlighting that. that brings us nicely on to our next question about challenge. So we all face challenges in our careers. Can you share a particularly challenging story in yours, how you tackled it what the lesson was that it left you with?

Well, we've covered it, which is that I was presented with the fact that, I was going to be a single parent, and it was going to happen rather quickly, and that I needed to make a decision. I was at the time in a senior role in a banking environment, and I had to make a decision in terms of my career, and I chose to not put my Children through nannies and things like that and that I would, reward myself by doing a PhD while they were at school. I could do the research while they were at school and I would reward myself with this. That's essentially a very simplified version of how it happened. I'd always wanted to do a PhD, so it wasn't just then, but you know, kids got in the way. So I thought that if I was going to make this decision, that this would be a really nice reward, that the PhD that I'd always wanted to do, I might be able to reward myself with that.

But what actually happened was it began a new career by stealth. I didn't see it happening. GDPR got announced while I had started a PhD in 2016 on information privacy in Dublin City University in the business school. so GDPR was that big thing. And we knew that it was going to be really, really big. And I had worked previously with my now CEO and he wanted to set up an extension to the cybersecurity consulting team that they had. And so that's why I joined him a couple of days a week to help him do that. And it worked but I had a lot of people say to me at that time. Don't do this. Don't do a PhD. You're crazy. You're mad. But they didn't, and no one understood the motivation that it was for me. No one can tell you whether you're right or wrong. If they don't understand the why. What you're doing and why you're doing it. And I was doing it for me, not for achievement, not for anything other than I'd always wanted to do it. And that this was the best opportunity that I had.

And it turned out to be the best decision that I ever made stemming from the worst crisis in my life. It was a fantastic decision and a very positive one. My kids were delighted that they had somebody at home who was able to make lunch for them when they came home and I was able to study and do research from home and so everything worked really, really well as a result.

But Somebody asked me a question recently, and I thought it was interesting Well, wasn't it really how you respond rather than what you're doing, going, and it made me think it is about the response. It's how you respond to crisis. So, you know, a simple crisis, often not simple, but a privacy incident, you've got a breach.

How we respond to that breach is in fact the most important thing, not the breach itself. The breach is most likely going to happen. have you planned how you're going to respond? Have you practiced how you're going to respond? Do you have the skills to respond appropriately? And do you have the communication skills and the project management skills to pull everyone together? It's how we respond that makes all the difference. So that would be probably the biggest challenge in my career and what I did to work around it.

Thank you for sharing that with us. It's a really nice heartwarming note to spend on. I do have one question and this is generally related to decision making. So when it comes to making decisions, do you kind of follow your gut instinct? Is there an innate instinct that drives you to make a decision or do you have a mental model that you follow for your decision making?

I would say I'm a very emotional thinker rather than a rational thinker. So I make decisions, believe it or not, very, very slowly, but when I make them, it happens quickly. So in other words, I'm mulling something for a long time. But once I decide yes or no in my head, it will happen, whatever the decision is. So for instance, one day I was walking past a car lot and I saw a car that I wanted and I went in and I got it. That's what they saw. I had been thinking about looking for a particular car for about a year in my head and online and test drives, but that's not what people around me saw.

They just saw me with a cup of coffee coming out of a coffee shop one day saying, I'm going to go in there and buy a car. So whilst I may look like I'm decisive and impulsive, in fact, I mull things over for a long, long time. I'm not a procrastinator. I don't procrastinate for a long period of time.

I have a son who's the king of procrastination, but I don't think that's me. But I can be ruled by my heart rather than my gut, so what I do is I often ask those around me and that's about personal decisions. In work decision, say at this point in my life, career, I'm pretty able to make decisions, but when they're financial decisions, I tend to take support and take in information from others and take data points from around me. So I'm very open to different views. but I'll make my own mind up.

Thank you for sharing. Now, at the end of the podcast, we always give the guests an opportunity to ask me a question. So what would you like to ask me?

You've established your firm and it's growing. So what next for Kazient and Jamal?

I think right now and for the rest of this year. I'm focusing a lot more on the coaching side of the business, helping people. And the main reason for that it's just so fulfilling. Like just yesterday I had two people, one from South Africa, she just finished a training last week. She went and passed her exam. So she was thrilled. And then there was another gentleman who's based here in the UK. He called me in he just passed. I was like bouncing up and down both of those times, calling everyone on my team. Hey, Melinda's just passed. And, have you heard he's just passed as And so it's so fulfilling. And I really actually want to lean in on that, a little bit more and really focus on the accelerator program, which is our signature program, the 12 week program, and just really taking that to another level. So right, right now it's a great program, but I only take on a limited amount of people because I can only give. That many people in my attention and focus that they need and deserve to go from here to superstar And so what I want to do is find the components of that work and make them even better find the things that maybe don't make much of a difference and get rid of them So that we don't have to waste time And then find other things that i've been working on with some of my coaches that I know is going to come in and become A real big game changer and give people even better resource even faster And for even longer. So I think that's going to be the key focus for me for the rest of 2024 at least is really focusing on the academy and helping lots more individuals and professionals really get the, success that they want and deserve by putting in the effort.

Thank you so much for your time on the podcast It's been an absolute pleasure speaking to you. You have no idea how long I’ve been waiting to be able to have a conversation with you Not necessarily just on the podcast, but just have a conversation with you really excited that we got this opportunity. The podcast has been so insightful and so valuable. We started off by looking at the kind of top skills and qualities that we need. We then moved into looking at what makes a truly exceptional, privacy professional or data protection officer. And then you even gave some really important points on how to make sure that we can actually add impact and magnify and amplify the impact that we can have in our work. And then we looked at specific skills that we actually need. And then you shared some really personal stories about how you overcame challenges.

And also you shared some insights into how you go about making decisions, which was really interesting. So many valuable tips there to take away. And I also got two great book recommendations from you. Good to great and the art of tooting your own horn. So I'm going to be adding them to the collection behind me.

As soon as I get through my reading list, thank you very much for those recommendations and thank you once again for being so generous with your time and for everything that you do on LinkedIn to be a positive contribution to the industry. I'm inspired by you and I know so many of my mentees are. So thank you for everything that you do on behalf of all of us at the Privacy Pros Academy.

Thank you so much, Jamal. It's a pleasure to have been here.

If you enjoyed this episode, be sure to subscribe, like and share so you're notified when a new episode is released. Remember to join the Privacy Pros Academy Facebook group where we answer your questions. Thank you so much for listening. I hope you're leaving with some great things that will add value on your journey as a world class Privacy Pro.

Please leave us a 4 or 5 star review. And if you'd like to appear on a future episode of our podcast, Or have a suggestion for a topic you'd like to hear more about, please send an email to team@kazient.co.Uk. Until next time, peace be with you.