A privacy leader’s playbook for when the regulator comes calling

Summary A privacy regulator's letter lands at 9am, naming a specific webpage and a third-party ad tag that fires before consent is logged. What do you do first? Gemma Witham, Chief Privacy Officer at Skyscanner, walks host Ethan Prete through her playbook in the new segment The Regulator Who Asked First: stay calm, scope the request precisely, find out where it came from, run it as an incident, brief the C-suite early, and approach the regulator as a collaborator rather than a defendant. Gemma also explains why Skyscanner's PrivTech team, engineers embedded in the privacy function and trained on the why through IAPP courses, has transformed how fast her team executes, why a no-blame culture is how you get to the truth, how regulators like the ICO now ask technical, harm-focused questions that a cookie banner alone cannot answer, and why a CMP is the start of compliance, not the end of it. She closes with advice for the next generation of privacy leaders: stay curious and keep asking until the engineers explain it plainly. Essential listening for privacy, legal and marketing leaders responsible for what their websites actually do. Chapters 00:00 Intro 01:41 Twenty years in privacy, from afterthought to the table 05:05 First reaction to a regulator's inquiry 09:04 The 9am scenario 10:59 Do regulators understand the tech? 14:05 PrivTech: engineers inside the privacy team 18:44 Paper exercises, litigation and real harm 21:59 No blame game 23:24 How regulators evaluate tracking now 27:08 CMP myths and advice for the next generation Takeaways - First reaction to a regulator's letter is to stay calm, then scope it exactly: which page, which app, which market, and whether it came from an annual plan or customer complaints. - Run the response as an incident with an audit team, the PrivTech/marketing owners and early, transparent C-suite updates. - Downstream tags are hard to control, so continuous auditing and remediation is the only real defence against surprises. - Engineers embedded in the privacy team (PrivTech) transformed speed and quality; give them the legal why (IAPP courses) and they design better controls. - Regulators now ask technical, harm-focused questions; a cookie banner is only compliance if its firing is verified upstream and downstream. Connect with the Guest Gemma Witham LinkedIn: https://www.linkedin.com/in/gemma-witham-09442237 Company Website: https://www.skyscanner.net Sponsor Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. Learn more about your website here: https://www.observepoint.com/