Privacy is one of those things that’s easy for scale-ups to deprioritise, until that’s just not an option anymore.
At first, a reactive approach works fine. You deal with things as they come up, tick off what’s needed, and keep the business moving. But as you scale, that starts to change.
So how do you introduce a more structured, proactive approach, without slowing things down?
We spoke to a few experts to find out, including our customer Jarrolds - a multi-entity business that’s already been through this shift, building a privacy programme that works across the group without getting in the way of growth.
Tom Blake
Group Head of Technology at Jarrolds
Lead DPO at Trust Keith
Director of Revenue at Trust Keith
In the early stages of a business, data protection is rarely structured.
There might be a few policies in place, some good practices, and a general awareness that it’s important, but it isn’t always consistent or risk-led.
For Jarrolds, that was the starting point.
“We had lots of fingers in lots of pies, which comes with its own challenges as it scales out.”
Tom Blake, Group Head of Technology @ Jarrolds
At this stage, privacy tends to be handled as and when it comes up, often by a small number of people, without a consistent way of assessing or managing risk.
And that’s a familiar position for many businesses. An approach to privacy exists, but it hasn’t been built into how the business actually operates.
What worked early on starts to become less effective. The volume increases, the complexity increases, and there’s a growing expectation to demonstrate control.
As you scale, data protection challenges become less about individual tasks and more about how consistently privacy is managed across the business.
The same issues tend to come up again and again. Not because teams aren’t trying, but because their approach hasn’t evolved with the level of complexity they’re now operating in.
As we heard from Jarrolds, this becomes especially important in environments with multiple teams, systems, and use cases — where maintaining a clear, joined-up approach is harder than it first appears.
Tom Blake, Group Head of Technology @ Jarrolds
One of the first issues that often emerges is ownership.
Without a clear structure in place, responsibility often ends up sitting with one person - usually alongside their main role.
That might work initially, but it doesn’t scale.
As the business grows, so does the need for a more coordinated, business-wide approach.
Kayleigh Logan-Cleghorn, Lead DPO @ Trust Keith
Without that joined-up view, privacy becomes dependent on individuals rather than a consistent, business-wide approach.
As businesses grow, visibility often becomes a challenge.
Data sits across multiple systems, teams, and vendors, and without a clear structure in place, it becomes harder to maintain an accurate, up-to-date view of what’s actually happening.
That includes understanding:
“You need a way of looking at data, risk, and activity across the business, and prioritising what actually matters.”
Kayleigh Logan-Cleghorn, Lead DPO @ Trust Keith
Without that visibility, decision-making becomes more difficult.
As more teams become involved in handling personal data, ways of working can start to diverge.
Different departments often develop their own approaches - whether that’s how they assess risk, onboard vendors, or handle data requests.
That’s not usually intentional. It’s just a result of growth.
Mitch Omer, Director of Revenue @ Trust Keith
Some areas may have clear processes in place, while others are more reactive, making it harder to maintain a consistent standard or demonstrate control.
As these challenges build, many businesses find themselves relying on reactive, manual ways of managing privacy.
Handling requests as they come in, repeating similar tasks, relying on spreadsheets, inboxes, or individual knowledge to keep things moving.
That approach can work for a time, but it becomes harder to sustain as complexity increases.
Mitch Omer, Director of Revenue @ Trust Keith
Teams spend more time chasing information, redoing work, or sense-checking decisions, instead of moving quickly with confidence.
These privacy challenges don’t usually appear all at once. They build gradually — in day-to-day decisions, small delays — and ways of working that start to feel harder than they should.
At first, it’s easy to put it down to growth, but over time, the pattern becomes clearer.
You might recognise it when:
Mitch Omer, Director of Revenue @ Trust Keith
Individually, these don’t always feel like major issues, but together, they point to the same underlying problem: your approach to privacy hasn’t kept up with how your business operates today.
Moving beyond a reactive approach doesn’t mean adding layers of process or slowing the business down.
Done properly, it’s the opposite.
Good data protection isn’t about doing more, it’s about having the right structure in place so things can run consistently, without constant input or escalation.
A well-functioning privacy programme gives you:
Kayleigh Logan-Cleghorn, Lead DPO @ Trust Keith
Instead of reacting to issues as they arise, teams can:
Mitch Omer, Director of Revenue @ Trust Keith
For many businesses, privacy is still seen as something separate from commercial goals, but when it’s set up properly, that changes.
Privacy becomes part of how the business operates, not something that sits alongside it.
Instead of slowing things down, it starts to support:
Tom Blake, Group Head of Technology @ Jarrolds
Privacy needs to reflect how the business actually operates, not sit as a separate layer of process. That means understanding where data is used, how decisions are made, and where risk genuinely sits.
Tom Blake, Group Head of Technology @ Jarrolds
Putting in place clear, repeatable ways of working, so teams don’t have to stop and figure things out every time something involves personal data.
Kayleigh Logan-Cleghorn, Lead DPO @ Trust Keith
That includes:
When privacy is set up properly, it stops being something teams have to think about constantly, it becomes part of how things get done.
Mitch Omer, Director of Revenue @ Trust Keith
Building a structured, scalable privacy programme doesn’t happen overnight.
And for many businesses, the challenge isn’t knowing what needs to be done, it’s finding the time, resource, and expertise to do it properly, while everything else is scaling.
That’s where having the right support makes a difference.
At Trust Keith, we help businesses move beyond reactive privacy, supporting you to build a structured, scalable approach that fits how your business actually operates.
So instead of privacy sitting on your to-do list, we take it off your plate and keep it running in the background so it becomes part of how your business operates day to day.
Tom Blake, Group Head of Technology @ Jarrolds
Kayleigh Logan-Cleghorn, Lead DPO @ Trust Keith
Mitch Omer, Director of Revenue @ Trust Keith