Privacy, Governance & Risk
I'm a certified information privacy professional and technologist (CIPP/C, CIPT) with decades of experience in the nonprofit sector — that combination shapes how I approach this work: practical, and grounded in how organizations actually operate, not just what the rules say.
My approach is practical — I meet you where you are. I start by learning about your goals and how you're already working to achieve them, then work with your team to understand your unique context, identify gaps, and consider where innovation is needed. Your circumstances guide the work and shape the approach that's realistic for your organization.
Each organization is unique, so this work is tailored to fit — delivered as a focused project or through longer-term, fractional support, depending on what you need.
Privacy program services
Services might include:
Risk assessment: An assessment of your organization's current privacy risk position, measured against generally accepted best practices. Deliverables: a report summarizing your current state with recommendations, plus a prioritized timeline to guide implementation.
Program development & implementation: Following an assessment, I develop an achievable plan to help you meet your obligations. Deliverables: a co-created summary of program objectives aligned with your strategic goals, a prioritized timeline, and periodic check-ins.
Privacy policies and processes: Building privacy into your day-to-day operations through policies that help you meet your obligations without leaving you guessing. Deliverable: policy and process documents tailored to your organization.
Privacy Impact Assessments (PIAs): Identifying the privacy risks associated with your work, with clear guidance on how to meet your objectives while managing those risks. Deliverable: a report outlining risks and recommendations.
Fractional Privacy Officer: A dedicated, part-time privacy expert who knows your business and works directly with your team — without the cost of a full-time hire.
Training
Privacy is one of those things everyone means to take seriously, but in the rush of real work, small moments slip by — a file shared a little too broadly, a new tool added without much discussion. Those moments add up. Whether you're a small organization or a nonprofit, you're handling people's stories and identities every day, and that comes with a responsibility to protect them with care.
That's why I collaborate with newpact to make privacy practical, approachable, and doable for small teams and mission-driven organizations. If you're looking for a place to start, Navigating Privacy Risk for Nonprofit Leaders is a great foundation — and tailored versions are available too.
The Ottawa Food Bank connected with Firefly Strategic Consulting to deliver workshops to our network of member agencies on promising privacy practices. Heather adapted the material to our context and provided applicable actions for not-for-profit organizations who offer food programming. She was very knowledgeable: this was clear in how she distilled this complex topic into easily accessible information! The additional resources were likewise helpful in mapping out next steps. The feedback from our network was very positive. Our member agencies are now even better equipped to strengthen their privacy practices, ensuring all residents who access food programs can continue to feel safe knowing their personal information will be safeguarded.
Grey Bertrand, Coordinator, Community Development, Ottawa Food Bank
In the workshop provided to our members, Heather took a complex topic and made it accessible and more importantly, applicable to participants. She communicates privacy principles and the risks of not having protections in place in a way that encourages leaders to take action, without judgement, and by providing a realistic perspective on what is possible in a small organization. Heather's passion for privacy is evident in her delivery and participants leave the session feeling empowered to take steps towards improving their own practices.
Christine Trauttsmandorff, (former) Executive Director, Volunteer Ottawa
Responsible AI
AI is moving fast, and what it actually means for your organization depends on your context — your data, your team, your risk tolerance. I help clients get it right from the outset, building AI governance on the same principles that guide good privacy practice: understand what you're working with, build in safeguards early, and make decisions you can stand behind.
Services might include:
AI use policy & decision-making framework: A simple, practical framework your team can use to evaluate new AI use cases as they come up, grounded in real examples rather than abstract rules
Client communication & disclosure guidance: Clear guidance on how to explain your AI use to clients: what's being used, how information is protected, and where human oversight stays in place
Governance & accountability documentation: Making your existing AI practices visible and demonstrable
Staff training: Helping your team apply consistent judgment as AI capabilities keep evolving
Curious what this looks like in practice? Read about a recent engagement: What Responsible AI Can Look Like in Practice