I turn regulation into
systems people actually run.
Privacy, risk and compliance professional with four years of experience in healthcare and regulated data. I design controls and build the intake, tracking and monitoring workflows that keep them running.
01 / What I do
Three capabilities that work together
Translate regulation into controls
Risk and impact assessments, data inventories, vendor reviews and policies, written so that each control can be tested and evidenced.
Build the workflows that operate them
Intake, routing, deadline tracking, escalation and evidence collection, built in n8n, Make and Zapier to replace manual spreadsheet tracking.
Make sure teams use them
Process documentation, staff training and support at the point of work, so that controls are followed in practice.
02 / Selected work
Recent work
The recordings, documents and working systems behind these are on the projects page.
Platform build
An eight module governance platform in n8n
Intake, routing, inventory, monitoring and escalation, running as live modules. Control operation is evidenced as it happens rather than reconstructed for an audit.
Automation
Six compliance workflows with human review
Intake, routing, deadline tracking and escalation, including an AI triage step that classifies requests and drafts a first response. A person approves every decision.
Privacy operations
Data requests run against statutory deadlines
Requests handled end to end with structured review sets, redaction and an exemptions log. Data flows mapped across six processes to identify access beyond what was necessary.
Risk and third party
Risk and vendor reviews, tracked to closure
Risk assessments in GRC tracking formats and dashboards. Vendor and data sharing agreements reviewed with Legal, Operations and IT until remediation closed.
03 / Experience
Four years in healthcare and regulated data
AI Governance & Privacy Consultant
Jan 2025 to present
PMOps AI · Full-time · Remote
- Design and test controls across IT, vendor and data processes, documented so they can be evidenced rather than asserted.
- Built an eight module governance platform and six end to end workflows in n8n, including an AI triage step with a person approving every decision.
- Translate HIPAA, GDPR, and CCPA and CPRA requirements into practical operational controls.
Privacy & Compliance Analyst
Jan 2023 to Dec 2024
Transition House · Health and social services · Hybrid
- Mapped data flows and system access across six processes, finding where confidential records were reachable beyond the minimum necessary.
- Ran fifteen plus records and data requests end to end against statutory deadlines, with structured review sets, redaction and an exemptions log.
- Reviewed twelve vendor agreements and third party integrations with Legal, Operations and IT, tracking remediation to closure.
- Trained thirty five plus staff across four departments, driving adoption at the point of work.
Risk & Regulatory Advisory Assistant
Jan 2022 to Dec 2022
Planned Parenthood Federation of America · Healthcare provider · Remote
- Conducted ten risk assessments and compiled findings into GRC tracking formats and reporting dashboards for governance review.
- Reviewed twenty plus vendor contracts and data sharing agreements covering use and disclosure of confidential health information.
04 / The focus
High-risk AI in education
Schools increasingly use AI to assess children on attention, behaviour and risk. My research examines who is accountable when these systems get it wrong.
Consent offers children little protection when the school controls the system, which makes this a demanding test of any governance framework.
- MA thesis: a five stage lifecycle framework for high-risk AI processing children's biometric and behavioural data in schools.
- A twenty six page DPIA on a pupil scoring system, published in full. Three findings that would have stopped the project.
- A youth safety assessment of Character.AI, identifying where its age assurance falls short.
MA, Data Protection and Privacy (Law and Computing), Dublin City University, 2026.
Listen instead
Two episodes on related research.
COPPA changed. Now what?
What the rule change actually requires, and what it does not.
What the amended COPPA Rule actually requires as of April 2026, walked through one hypothetical EdTech company across four areas: biometric data, retention, third party sharing and security programmes, grounded in real FTC cases rather than a reading of the regulation.
The classroom that watches you
What these systems collect, and who answers for it.
AI, children, privacy and the machinery quietly installed in schools. What these systems actually collect, why consent does almost no work here, and where the accountability is supposed to sit.
How this applies beyond education
The method is the same in any sector: test each legal requirement against how the organisation actually operates, assess risk from the perspective of the individuals affected, build controls that generate their own evidence, and confirm that they are used.
I have applied it to data requests at a health and social services provider, to vendor and data sharing agreements at a healthcare provider, and to risk assessments tracked through to closure. Education is where I have gone deepest, not the only area I work in.
05 / Three regimes, one person
Most privacy professionals specialise in one legal system. My qualifications span three.
United Kingdom
UK GDPR, Data Protection Act 2018, ICO guidance
LLB, Anglia Ruskin University
European Union
GDPR, EU AI Act, DPIAs and records of processing
MA Data Protection and Privacy, Dublin City University
United States
HIPAA and HITECH, CCPA and CPRA, FERPA and COPPA, NIST
LLM, Northeastern University School of Law
06 / Background
Education and research
- MA, Data Protection and Privacy (Law and Computing), Dublin City University
- Thesis: Risk Based Governance of High Risk AI Systems Processing Children's Biometric and Behavioural Data in Educational Settings under EU Law
- LLM, Master of Laws, Northeastern University School of Law
- LLB, Law, Anglia Ruskin University
Frameworks
- GDPR
- HIPAA and HITECH
- CCPA and CPRA
- FERPA and COPPA
- EU AI Act
- NIST AI RMF
- NIST CSF
- ISO 42001
Tools
- n8n
- Make
- Zapier
- OneTrust
- ServiceNow GRC
- Vanta
- Drata
- Securiti.ai
- Claude and ChatGPT
Contact
Get in touch
Whether you are hiring for privacy, compliance or GRC, or need support on a specific programme, I would be glad to talk.