Inside the Privacy Governance Conversation

Sentinel Insights, Syrenis and Myna Partners hosted an event for privacy leaders in Atlanta for an engaging discussion on the future of privacy, compliance, and data governance.

Moderated by Dave Cohen, Director at Myna Partners, the panel brought together leaders from some of the world's most influential organizations:

• Luiz Santos, Senior Managing Counsel – Privacy, NCR Voyix
• Phillip Mahan, Sr. Director of Privacy & Compliance, GoTo Foods
• Pedro Pavón, Global Public Policy Director: Data and AI Monetization, Meta

Before diving into the discussion, participants agreed to operate under Chatham House Rules, creating an environment where practitioners could openly share challenges, lessons learned, and perspectives without attribution. That openness led to a candid and highly practical conversation about the realities organizations face as privacy programs mature.

We are grateful to Dave and the panelists for sharing their time, experience, and perspectives with the Atlanta privacy community.

The Conversation Has Moved Beyond Compliance

One theme surfaced repeatedly throughout the evening: privacy is no longer just a compliance function.

For years, privacy programs were largely measured by policies, notices, and regulatory requirements. Today, organizations are grappling with a far more operational challenge. Data flows through websites, applications, marketing platforms, AI systems, customer databases, and third-party vendors at a scale that few organizations could have imagined a decade ago.

The question is no longer simply, "Are we compliant?"

The question has become, "Do we actually understand how data moves through our business?"

That shift is pushing privacy teams to work more closely with marketing, IT, product, security, and executive leadership than ever before.

Governance Is Becoming More Important Than Documentation

Another recurring theme was governance.

Most organizations have policies. Many have consent management platforms. Most have legal requirements documented somewhere.

What practitioners are struggling with is maintaining visibility and control as systems evolve.

Websites change. Vendors change. Marketing technologies change. New AI tools appear. Business priorities shift.

Governance is increasingly about creating processes that can adapt to those changes while maintaining trust and accountability.

In many organizations, privacy leaders are moving away from acting solely as reviewers and toward becoming business partners who help teams navigate risk while still achieving business objectives.

The challenge isn't simply compliance.

The challenge is creating governance structures that continue to work as technology changes around them.

User Trust and Business Value Are No Longer Opposing Forces

One of the more interesting discussions centered on a misconception that still appears in many organizations: that privacy and business growth are fundamentally at odds.

The reality is more nuanced.

Consumers increasingly expect personalized experiences. They expect relevant recommendations, tailored content, and seamless digital interactions. At the same time, they expect transparency and meaningful control over how their information is used.

Organizations that can balance those expectations effectively are often rewarded with stronger customer relationships and greater trust.

The discussion highlighted an important shift in thinking: privacy is not necessarily about restricting data use. Increasingly, it is about enabling responsible data use.

That distinction matters.

The organizations that view privacy as a trust-building function rather than a compliance burden are often better positioned to create sustainable customer relationships.

Privacy Teams Need a Path to "Yes"

Privacy professionals have long battled the perception that they exist to slow projects down.

Many attendees recognized that this mindset is becoming increasingly unsustainable.

Business teams need guidance. They need risk assessments. They need practical recommendations.

What they do not need is a blanket "no."

The most effective privacy programs are helping organizations find compliant paths forward rather than simply identifying reasons a project cannot proceed.

That requires collaboration between legal, marketing, IT, product, and governance teams. It also requires privacy leaders to understand business objectives just as deeply as they understand regulatory obligations.

The future of privacy leadership may depend as much on partnership skills as legal expertise.

Visibility Is the Missing Piece

Perhaps the strongest takeaway from the evening was the growing recognition that organizations cannot govern what they cannot see.

Policies are important.

Consent mechanisms are important.

Audits are important.

But none of those things guarantee that day-to-day operations actually align with organizational intent.

As privacy programs become more sophisticated, leaders are increasingly looking for ways to validate that their controls are working as expected—not just during an annual assessment, but continuously.

That visibility gap is becoming one of the defining challenges of modern privacy governance.

Looking Ahead

The Atlanta discussion reinforced something we hear regularly from privacy leaders across industries: the next phase of privacy maturity will be defined less by policy creation and more by operational execution.

Organizations already know they need governance.

They already know they need compliance.

What many are still trying to solve is how to maintain visibility, accountability, and trust across increasingly complex digital environments.

Privacy governance sits at the intersection of all three.

As regulations evolve, AI adoption accelerates, and digital ecosystems become more interconnected, the organizations that succeed will be the ones that can turn privacy from a periodic compliance exercise into an ongoing governance capability.

Thank you again to Dave Cohen, Luiz Santos, Phillip Mahan, and Pedro Pavón for contributing to a thoughtful and engaging discussion. Conversations like these help move the industry beyond theory and toward practical solutions for the challenges privacy leaders face every day.