The essential skills for a DPO, AI Regulation, and business resistance: an interview with Tatiana Zaplatina on what’s important for privacy professional nowadays

“A company has to be genuinely shaken by the consequences before there is real motivation”: AI regulation challenges

Since Tatiana’s career focus is increasingly tied to AI governance, we went deeper into the topic and discussed several issues that are particularly painful for specialists right now.

AI regulation today is where personal data protection was about ten years ago. The world recognizes the scale of the technology, but not everyone is ready for strict rules. Tatiana notes that the gap between the European approach and practice in other regions is becoming more visible. While Europe is adopting a risk-based model, many companies elsewhere still treat AI as a “black box” that does not require much oversight.

The key difference in the European approach is that it is systematic and predictable. The adoption of the AI Act was a landmark event. It established a clear hierarchy of AI systems based on the risks they pose to fundamental rights. In regions where dedicated legislation has not yet emerged, a legal vacuum exists, and companies are not always eager to fill it on their own.

“European countries have a clear understanding of what kinds of rights violations AI can cause and at what scale. They also have a clear system for classifying AI. In countries where that does not exist, whether China or the CIS, regulation remains largely at the state’s discretion. But I believe companies should implement internal policies even if direct legal regulation is not there yet. There should be governance standards that allow technologies to be deployed and configured correctly. This is a major advantage of EU law: they were first to adopt the AI Act, and they see the problem.”

Why does business ignore AI compliance?

Tatiana says one of the biggest issues is how casually businesses treat risk. Leadership teams often view AI adoption as a way to cut costs or reduce headcount, while overlooking the security of the data used to train models.

“Right now, companies see AI simply as a way to make work easier or reduce staff, focusing only on their own interests. But you should not start with optimization. You should start with proper configuration and bringing in the people who can secure the infrastructure.”

When there is no clear regulation, businesses simply do not take risks seriously.

“Business needs to feel the threat. If they do not see it, they will not deal with it. With AI it is the same as with personal data: until a company is publicly fined, until it takes a major financial hit, or until people stop buying its products, it will not truly internalize the problem. Many think, ‘Fine, we paid the penalty, but the profit is still higher, so we move on.’ A company has to be genuinely shaken by the consequences before there is real motivation.”

With this kind of complacency, companies also fall into a dangerous trap: losses can be much greater than the fine itself, and they may creep up unnoticed. Data leaks through AI agents or misconfigured algorithms might not show immediate impact. Instead, they can trigger a delayed wave of harm. And until the organization sees it, it lives under an illusion of safety.

“There is a huge gap between the leak itself and the consequences. If an AI system had access to insider information or client databases and sent that data to an uncontrolled cloud environment, the company might not notice right away. When the first warning signs appear, they are ignored. And when the damage becomes serious, it may already be too late. The company may no longer have the time, people, or money to fix it.”

“It is hard to talk about ethical AI when the company does not even have an access matrix”: on professional challenges and the drive to grow

For an AI compliance specialist, one of the main challenges is internal resistance. Initiatives around data protection and ethical AI are often seen as a brake on product development. Tatiana emphasizes that the specialist is working not only with laws, but also with business psychology, and sometimes with a complete lack of basic digital hygiene.

“I have seen organizations literally throw copies of passports out onto the street without even bothering to shred them. It is outrageous negligence.”

Low process maturity slows everything down. Specialists still have to take reality into account and build compliance not “by the book”, but in a way that is feasible in a given business environment.

“It is hard to talk about ethical AI when a company does not even have an access matrix for employees. Maybe at some point they will get there themselves. So you need an approach that fits companies at different levels of maturity.”

Some businesses lag behind due to their stage of development. Others, in pursuit of maximum profit, ignore user rights and neglect security measures.

“I constantly run into situations where business treats compliance as a limitation on efficiency. In those cases, I always work through risk calculations: possible fines, the cost of a project, and the likelihood of consequences. Unfortunately, sometimes companies ignore advice, and then consequences follow. But there is a silver lining: once the problem ‘blows up,’ people become more engaged. They start training employees and adopting policies. As long as sales are strong and nothing happens, everyone is happy.”

Tatiana considers this constant search for compromise between business interests and user interests the hardest part of the job.

“The hardest part of being a DPO is finding the balance between risks and regulatory requirements. It is crucial to understand business processes and build guardrails that ensure legality without getting in the way of growth.”

To handle compliance challenges and find those compromises, Tatiana highlights three key soft skills for privacy professionals: communication, analytical thinking, and empathy toward the business. Empathy helps you understand processes from the inside and build boundaries that keep things lawful while still allowing the business to grow and stay profitable.

No matter how difficult compliance work can be, the most important thing is to remember why it matters.

For Tatiana, the real value of working in personal data protection is the ability to bring order to processes and turn information chaos into a stable, transparent system. When processes improve, it delivers not only real results for the company, but also deep personal satisfaction for the specialist who helps lay the foundation for a more ethical technological future.

Conclusion

Tatiana Zaplatina is another specialist who, to our delight, shares the same privacy ideals as the DPO Europe team. Instead of formal replies to regulators, she advocates understanding the real mechanics of personal data use. Instead of a careless attitude toward complex technologies, she emphasizes protecting user interests even in places where someone might still “throw passport copies out onto the street”. You, too, can become that kind of specialist, contribute to society, and gain real satisfaction from meaningful work.