Privacy is a decision capability.

Organisations make decisions that affect people long before the privacy implications become visible. The question is whether they have the capability to recognise when those decisions create privacy risk, understand the potential harm to people, bring the right disciplines together early enough, and change the decision or its outcome.

Explore the research →

Core work

How organisations make decisions that affect people, where privacy risk is created, and what allows privacy to change the outcome.

What an organisation needs to be capable of doing if privacy is to operate as a decision capability.

How decision rights, interfaces, accountability and escalation make that capability possible.

The research programme

How do organisations actually make decisions about people, and what makes those decisions better or worse?

  1. Operating model
  2. Privacy capability
  3. Decisions about people
  4. Privacy impacts and potential harms

Current research

  • Governance vacuum

    How responsibility falls between privacy, data, AI, legal, risk and business teams when no one function owns the decision.

  • AI governance disclosures in the ASX50

    An examination of what Australia’s largest listed companies disclose about AI oversight, accountability and governance.

Fiona Chan

Fiona Chan

Fiona Chan is an Australian lawyer and senior privacy practitioner. Across more than fifteen years in legal, compliance, privacy and governance roles, more than eight of them spent on enterprise implementation and programme work, she has designed, built and run privacy, data and AI governance inside regulated businesses.

She is an admitted solicitor and holds the CIPP/E, CIPM, CIPT and AIGP certifications. The work published here comes out of that practice, out of seeing where operating models hold and where they quietly stop reaching the decisions that matter.

About Fiona →

Perspectives

All perspectives →

Speaking

Fiona speaks on the themes developed through this work, including privacy as a decision capability, organisational privacy capability, privacy, data and AI governance, judgement, harm and operating-model design.

Event organisers working on these questions are welcome to get in touch about what would be most useful for their audience.

Explore speaking topics →