The Privacy Capability Framework

Privacy capability is not the same as knowing the rules or producing the right artefacts. The framework distinguishes four levels of practitioner capability and the organisational conditions that allow that capability to develop, plateau or be suppressed.

Capability is a property of the practitioner and the structure around them.

The four levels

  1. Rule Knowledge
  2. Operational Fluency
  3. Risk-Disciplined Judgement
  4. System Shaping

The levels are cumulative, and the higher ones are not more privacy knowledge. What separates them is set out in the framework.

The structural overlay

The same practitioner can present very differently in different operating models. Role design, line placement, proximity to business decisions, authority and exposure can either develop capability or suppress it.

The useful question is therefore not only “What level is this person?” It is also “What level is the role asking them to operate at, and is the operating model giving that capability room to develop?”

From operational fluency to judgement

The framework identifies the move from Operational Fluency to Risk-Disciplined Judgement as its critical transition. More training alone does not reliably create it. The transition requires exposure to real operational decisions and structural conditions in which judgement can actually be exercised.

The framework

The full framework sets out the four capability levels, the structural conditions that shape them and the implications for capability development inside privacy functions.

Read the framework →

Related work

Selected work on how privacy capability develops and whether it can operate in practice.