One of the keys to the effective implementation of a privacy programme within an organisation is ‘the company buy-in’; getting stakeholders to believe in the programme and contribute to its success. To do this, some may cite the fines imposed for non-compliance, particularly under the GDPR. However, with such an approach, the impression that one may dev…