The root cause analysis said human error. It wasn’t wrong, but it had stopped too early.
Customer statements were being emailed to the wrong recipients. The analyst responsible was working across three systems that did not integrate, reconciling duplicate customer profiles and out-of-date contact details by hand. The process depended on sustained attention while making that attention unnecessarily difficult.
One privacy practitioner assessed it as a breach and reminded staff to check recipient details. Another blocked email attachments, which stopped the approved process and pushed staff into workarounds. A third traced the recurring incidents back to the broken workflow and escalated the data-quality and system-integration problem that was producing them. A fourth recognised that the business was already redesigning how customers received their documents through a whole-of-business portal program, and used that initiative to build secure delivery into the service itself, so the manual process that kept producing the error no longer had to exist.
The first practitioner knows the rule; the second can turn it into a control; the third can locate the consequential decision beneath the incident and give the organisation a way to address it; the fourth can shape the practices and systems that determine whether the incident class arises at all.
Qualifications, seniority and the quality of the documents a practitioner produces are often used as proxies for privacy capability. They tell us something useful, but they do not tell us what the practitioner can do when the rule does not settle the answer, the business wants to proceed, and the consequences will be carried by somebody who is not making the decision.
In Privacy as a decision capability, I describe a compliance loop. The external system rewards evidence that privacy work was done, organisations build the capability to produce that evidence, and the documents that result are reported back as proof that privacy is working. Capability and the operating model are the two levers in that loop an organisation can move for itself, and moving the first means being precise about what is being built, because practitioner capability is not one skill. It develops across four levels, and the transition that matters most is easily mistaken for greater knowledge or experience.
Four levels, four different kinds of reach
The four levels are cumulative: Operational Fluency depends on Rule Knowledge, Risk-Disciplined Judgement depends on both, and System Shaping does not leave the rules or professional method behind but uses them while working on a wider part of the organisation.
| Level | Capability | What the practitioner can do | Observable distinction |
|---|---|---|---|
| Level 1 | Rule Knowledge | Identify the relevant privacy requirements, internal rules and regulatory guidance | Gives an accurate rule-based answer and escalates when the rule does not resolve the situation |
| Level 2 | Operational Fluency | Apply privacy methodology and translate requirements into assessments, controls, notices, findings and other professional work | Produces credible privacy outputs and can run established privacy processes consistently |
| Level 3 | Risk-Disciplined Judgement | Locate the consequential choice, reason from effects on people, test necessity and proportionality, develop workable alternatives and identify who must own the unresolved risk | Gives the decision owner a position they can act on when the answer is ambiguous or contested |
| Level 4 | System Shaping | Recognise when recurring privacy outcomes are being produced by the surrounding organisational system, and shape the decision pathways, professional routines, interfaces, escalation arrangements and distribution of capability through which they arise | Changes the conditions that produce privacy decisions rather than relying on individual intervention each time |
Level 1: Rule Knowledge
A practitioner at Level 1 can identify the applicable privacy obligation, explain what the rule or internal standard requires, draft rule-based material and recognise when the text does not answer the question. Accurate interpretation and disciplined escalation are capabilities in their own right, particularly where the obligation is clear and the cost of getting it wrong is high.
They cannot yet reliably carry the rule into a contested operational decision when the facts do not map cleanly to the text, the available options have different consequences for people, or the business needs a workable route rather than another statement of the requirement. The privacy issue may be identified correctly while the decision producing it remains untouched.
Level 2: Operational Fluency
A practitioner at Level 2 can apply professional privacy methodology consistently. They can conduct an impact assessment, assess a vendor, draft a notice, document breach triage, design a control and run the established processes through which a privacy function produces credible work.
They cannot yet reliably determine when the accepted boundaries of that work are themselves the problem. A careful assessment can still assume that the purpose, technology, supplier and timetable are fixed; a technically correct control can still fail in the workflow where people have to operate it.
Level 3: Risk-Disciplined Judgement
A practitioner at Level 3 can find that choice. They can reason from the likely effects on the person, test necessity and proportionality, distinguish a material concern from a theoretical one, develop an alternative the business could actually use and make clear which unresolved risk belongs to the decision owner. The answer need not be no; it must make the consequence and the available choices difficult to ignore.
They cannot yet reliably turn that judgement into the repeatable practices, decision pathways and distributed capability through which the organisation handles privacy questions. A Level 3 practitioner may handle a difficult decision well and still depend on personal access, experience or influence each time another one arrives.
Level 4: System Shaping
A practitioner at Level 4 can recognise when recurring privacy outcomes are being produced by the organisational system around individual decisions, and work on that system. They can shape decision pathways, professional routines, the interfaces between functions, escalation arrangements and the distribution of capability so that good privacy work depends less on one expert entering every difficult conversation at the right moment. They usually do this by working through the organisation’s existing initiatives, forums and sponsors rather than from a blank sheet.
System Shaping cannot substitute for the organisation around it. It does not give one practitioner ownership of business risk, create independent challenge where none exists or make decision rights real by describing them. If the system still works only when that practitioner intervenes personally, the expertise is concentrated rather than institutionalised.
The capability also needs a position from which change is possible: a Chief Privacy Officer or equivalent mandate, or direct sponsorship from an executive who can change decision rights, reporting lines, forums, escalation paths and resourcing. The business owner still owns the decision and its consequences.
Reading the levels
The framework describes capability demonstrated across a body of work, not a permanent identity assigned to a person. The same practitioner may make moves at different levels as the problem changes, and the role may conceal capability by allowing only a narrow part of it to be exercised.
A senior title does not establish Level 4 capability, and a junior title does not prevent somebody from demonstrating Level 3 judgement. Nor are the levels a moral ranking. Privacy functions need practitioners who can interpret rules accurately and people who can operate the professional methods that turn those rules into reliable work.
A Level 1 answer may be exactly what is needed when an obligation is clear and the task is to interpret it accurately. A Level 2 practitioner may run a strong impact-assessment process, design a control that genuinely reduces risk or bring discipline to a records-management program that previously had none. These are substantive capabilities, not lesser work waiting to become strategic.
The limits appear when the question changes. A proposed data use may be legally available but difficult to justify to the people affected. A control may be sound on paper but impossible to operate in the system where it has to live. An incident may look like an employee mistake while being produced repeatedly by a workflow the employee cannot change. An assessment may identify the privacy issue without identifying the decision that created it.
The difficult transition is between Levels 2 and 3
The move from Rule Knowledge to Operational Fluency can usually be developed through instruction, professional methodology, supervision and repetition. A practitioner can learn how to conduct a privacy impact assessment, build a record of processing activities, draft an effective notice, assess a vendor or document breach triage. The work may be complex, but the development path is recognisable. It is also the path the compliance loop rewards: a system that asks for completed assessments, current policies and closed findings is asking for Operational Fluency, and an organisation can hire for it, measure it and promote on it without ever needing anyone to go further.
The move from Operational Fluency to Risk-Disciplined Judgement is different. I call it the Judgement Shift.
The Judgement Shift occurs when the practitioner stops treating the privacy output as the boundary of the problem and starts reasoning through the decision the output is meant to inform. The practitioner still knows the law and still uses the method, but can also identify where the organisation has a real choice, what each option will do to the person affected, whether the intrusion is necessary and proportionate, what a less harmful alternative would require, and which unresolved question belongs to the business owner rather than privacy. It is the point at which the person the organisation is making a decision about comes back into the privacy work, as someone who will carry the consequences rather than a data subject described in an assessment.
Technically strong privacy work can still have little effect when it accepts the boundaries of the proposal as fixed. A control can map cleanly to a requirement while pushing the work into a less visible channel. A recurring finding can be closed correctly each time without anybody asking why the organisation continues to produce the same event.
Risk-disciplined judgement does not guarantee that privacy gets its preferred answer. The business owner retains the decision. The capability lies in making the privacy consequence and the available alternatives clear enough that the owner has to decide with them in view. Sometimes the proposal proceeds. Sometimes its purpose narrows, the data changes, a supplier condition gains real force or the design is rebuilt. Occasionally it stops. What changes is that the privacy work reaches the choice rather than recording what happened around it.
The difference between Levels 2 and 3 is therefore not confidence, seniority or a willingness to say no. A confident practitioner can still be confidently applying the wrong frame. A cautious practitioner may be exercising excellent judgement by narrowing a claim, asking for evidence or recognising that another discipline is better placed to resolve part of the problem.
What separates the levels is the quality and reach of the reasoning: whether the practitioner can move from the privacy requirement to the decision creating the risk, carry the interests of the person affected into that decision, and give the organisation a defensible way to act.
The judgement extends to AI decisions
AI governance is being defined quickly, and much of that definition is new knowledge: AI-specific regulation, management standards, impact assessments, model inventories and the certifications that go with them. All of it is necessary, and all of it extends the first two levels. A practitioner who learns a new law and a new assessment method has extended their Rule Knowledge and Operational Fluency, which is a real gain and the easiest kind of capability to certify.
What an AI proposal asks of the organisation is closer to what a privacy proposal asks than the new vocabulary suggests: whether a use of data and technology should proceed, on what terms, with what effect on the people it touches, and who owns the risk that remains. That is the question Risk-Disciplined Judgement already answers, and System Shaping already works on the pathways through which such proposals reach a decision (for many organisations, the program standing up AI governance is now the initiative through which those pathways can be changed). An organisation that has built privacy as a decision capability already has the depth of judgement AI decisions need, and can extend it by adding domain knowledge and technical specialists. An organisation that has not will tend to build AI governance the way it built privacy compliance, with a register, an assessment template and a committee: the same loop in a new domain.
None of this means privacy should own AI governance, or that privacy is the only discipline capable of this judgement, and it does not reach data governance, which is an adjacent discipline asking different questions about ownership, quality and lineage. The extension is a proposition drawn from practice, not yet a finding.
Judgement develops in the work
Training has a legitimate and necessary place in privacy capability. It builds knowledge, introduces professional method, creates shared language and gives practitioners a safer environment in which to try unfamiliar work. A function without those foundations will not reach higher-level judgement by simply exposing people to harder decisions.
But more training does not, by itself, produce the Judgement Shift. A practitioner develops judgement by participating in decisions where the answer is not already contained in the policy or template, seeing how experienced people distinguish material concerns from theoretical ones, and learning what happened after the advice left the privacy function.
Four conditions make that development possible.
Access before commitment. The practitioner needs exposure to real business decisions while the purpose, design, supplier, data and timetable can still change. A role that receives completed proposals for review can develop review capability. It cannot reliably develop the judgement required to shape those proposals.
Permission to form a view. Practitioners need to be expected to exercise judgement, not merely identify requirements and document findings. That permission includes being able to say that a proposed remediation addresses the visible symptom but leaves the cause untouched.
Calibration. Less experienced practitioners need access to people who can test the reasoning, distinguish a material privacy concern from professional discomfort, and explain why an apparently attractive recommendation will or will not work inside the business. Calibration is not the senior person taking over every hard question. If that keeps happening, the senior practitioner becomes the function’s permanent substitute for development.
Feedback after the advice. Practitioners need to know whether the decision changed, why their recommendation was accepted or rejected, what consequence followed, and whether the control worked once it met the operation. Without that feedback, the function can improve the document while learning nothing about the decision.
None of the four is something the compliance loop asks an organisation to provide, which is why a program measured by its outputs can run for years without them. These conditions also explain why qualifications and years of service are incomplete proxies for capability. A practitioner can spend years producing sophisticated Level 2 work in a role that never exposes them to the decisions through which Level 3 judgement develops. Another practitioner may acquire that judgement earlier because the role places them close to product, technology, data or operational choices and gives them supervised responsibility for forming a position.
Experience matters, but only if the experience contains the capability the organisation expects it to build.
The operating model can hide the capability already there
A practitioner’s capability and the conditions in which they work are related but not interchangeable. The framework describes what the practitioner can do. The operating model determines when the practitioner is invited to do it, what question they are asked, who hears the answer and whether the answer has any consequence.
In a late-review role, a practitioner may be capable of Level 3 judgement but receive work only after the practical decision has been made. The role asks for an assessment, a finding and a record of residual risk. Observed in that work, the practitioner looks operationally fluent because operational fluency is all the role permits them to demonstrate.
Early access can expose the reverse problem: a practitioner placed close to consequential decisions without the judgement, support or escalation discipline the role requires. Access cannot compensate for a capability gap any more than capable people can compensate indefinitely for arriving too late.
Level 4 makes the interaction particularly easy to confuse. System Shaping includes the ability to shape decision pathways, professional routines and the distribution of capability across the organisation. A Level 4 practitioner can contribute substantially to operating-model design. That does not mean the practitioner is the operating model, or that one unusually capable person can replace clear accountability, independent challenge and decision rights.
A capability framework can still be used badly
A four-level framework is easy to turn into a hierarchy of people, which would defeat its purpose.
Not every privacy role requires Level 4 capability, and not every decision requires a Level 4 response. A clear regulatory interpretation should not be inflated into operating-model redesign. A well-understood process does not need to be reopened merely so somebody can demonstrate strategic range. Higher capability includes knowing when the narrower answer is the right one.
The levels should not be used as an informal performance rating or promotion shortcut. A role may suppress capability, a manager may carry every difficult decision personally, or a function may reward the production of documents while saying it wants judgement. Without understanding those conditions, the organisation can mistake constrained performance for individual limitation and respond with training, hiring or performance management that cannot solve the problem.
The framework is intended to make the differences in practitioner capability visible. Assessment is a separate exercise, requiring evidence across decisions, clear criteria, appropriate calibration and safeguards for the people being assessed.
Which level was in the room
Privacy as a decision capability ends on a question for boards: did the decision change because privacy was there? The framework adds the question underneath it. When a decision did change, which capability changed it: a rule correctly applied, a control well designed, a practitioner who found the consequential choice and put an alternative in front of the owner, or someone who had already changed the route so that the choice arrived in time? And when a decision did not change, was the capability missing, or did the operating model keep it out of the room?
Most organisations cannot answer either question, because the loop measures privacy by what it produces and nothing it produces records who reasoned through the decision. An organisation that can answer them knows what it has actually built, and where the next practitioner it hires, develops or moves will make a difference.
Evidence note
I developed the framework from privacy work across financial services and critical infrastructure, including building privacy functions, mentoring senior practitioners and observing what happened when privacy advice met decisions under pressure. It is a practice-derived conceptual framework, not a finding from a representative study. The opening incident is an illustrative composite used to distinguish the four levels; it does not describe a specific organisation.
I have since tested the framework in simulated privacy decisions, using synthetic participants, to check whether the four levels can be told apart in how a decision is reasoned through. Within that instrument they can, and the same participant sometimes moved between levels during a single decision. Synthetic participants cannot show how human practitioners behave or how capability is distributed across the profession, so testing with practitioners is the next step.
Suggested citation: Fiona Chan, “The Privacy Capability Framework”, fiona-chan.com, version 1.0 (2026), https://fiona-chan.com/privacy-capability-framework/.