For the past three months I have been deep in the detail. Partner calls, customer reviews, renewal conversations and long sessions with privacy and compliance practitioners about what their working weeks actually look like. It has been the best possible introduction to this business.
This week I presented our three-year strategy to shareholders, and our board has approved the 2027 budget that underpins it. I thought it would be useful to set out what we are building and why.
Our vision and mission
Our vision is to be the global standard for data privacy management by being the easiest platform in the market to buy, deploy and use.
Our mission is to give every team accountable for privacy, AI and risk a platform that is simple to adopt and easy to live with every day: AI-assisted, human-verified, audit-ready.
Putting “easy” at the centre of a strategy can sound simplistic. I think it is the most demanding standard we could set ourselves. The people who run privacy programmes are carrying more regulation, more AI and more supplier risk every year, usually without more headcount. When obligations grow faster than teams, the platform that serves them best is the one a busy privacy lead can get right the first time.
What I heard
Whichever country the conversation happened in, the same themes came back.
Privacy is often a team of one. A DPO, or a compliance lead who picked up privacy alongside three other jobs, is the norm rather than the exception.
Spreadsheets work until someone asks for proof. An auditor wants evidence, a regulator asks a question, or the board wants to know whether the programme actually ran. At that point the spreadsheet becomes the problem.
AI governance is landing on the privacy lead’s desk. Boards want to know where AI is being used, who approved it and who owns the risk. The privacy function is usually the closest thing the organisation has to an answer.
Supplier risk never stops. Every new vendor and every vendor that adds AI to its product is another set of questions about how personal data is handled. For most of our customers, third-party risk is a standing requirement rather than an annual exercise.
The programmes that last are the ones the business uses. Where enforcement has been slow, I have seen organisations buy a tool and let the programme drift. The ones that keep going run privacy because the business needs it: responding to access requests, checking suppliers, approving new uses of AI.
Partners want repeatability. The firms that advise on privacy want a platform they can run across many clients, to a consistent standard, without rebuilding the same work each time.
Buyers are tired of being sold to. They want to look at the product, see the evidence and talk to people who know the subject, on their own terms.
What we stand for
Those conversations shaped the principles we have written into the strategy.
- Easy by design. If a busy privacy lead can’t get a task right the first time, we haven’t finished the work.
- Proof over paperwork. Every control has an owner and an evidence trail.
- AI-assisted, human-verified. AI helps with the drafting, assessments and triage. People verify it and own the result.
- Your route, your pace. Run PrivIQ yourself or with a professional partner, to the same standard.
- We help you buy. Open, honest and transparent, with the tools to decide on your own terms.
- Speed to value. Customers see results in weeks, not after a long implementation.
Where we are investing
The plan I presented puts real weight behind those principles.
- Our partner network. We are enabling the partners we have and welcoming new ones, many of whom have come to us. Partners are how a lot of organisations first meet PrivIQ, so they deserve the training, tools and support to deliver well.
- New regions and markets. We are increasing our focus on the UK, Europe and North America, while continuing to build in South Africa and across the continent, where our roots run deep. The platform is hosted in the EU and South Africa on AWS, so customers in both regions have a local option.
- The mid-market. Organisations large enough to carry serious regulatory exposure are usually too lean to staff a large privacy department. They have outgrown spreadsheets and do not need an enterprise-scale implementation. This is where I see the biggest opportunity.
- The platform. Further investment in new features that build on the ease of use our customers already tell us they value. We have automated much of the data subject access request process, with requester verification and a full audit trail. A new data mapping experience goes live soon. After that comes our MCP server, which will further enable customers to drive their privacy operations and deliver insights. Alongside privacy compliance, PrivIQ already supports third-party privacy and AI governance.
- Making PrivIQ easy to buy. Simpler pricing and contracting, and more ways to evaluate the platform yourself, on your own terms.
- People and systems. New hires to support growth and investment in our own systems, so that growing faster never comes at the expense of the service our customers rely on.
Interest in the PrivIQ brand keeps growing. This plan is about being ready for it.
Growing the team
Our ambition over the next couple of years is to grow our teams in the Netherlands, the United Kingdom and South Africa. Software is only half of what customers buy from us. The other half is the people who help them configure it, answer the hard question at the awkward moment and stay with them long after go-live. Of everything in this plan, building those teams across our three countries is what I am keenest to get right.
Let’s talk
If any of this resonates, I would like to hear from you.
- If you are responsible for privacy or AI governance and want to see how PrivIQ could help your organisation, book a demo.
- If you advise clients on privacy, risk or compliance and want to join our growing partner network, get in touch through our Partners page.
- If you want to be part of the next stage of PrivIQ, as a colleague in the Netherlands, the UK or South Africa, get in touch through our Contact page.
Three months in, I am more convinced than ever that these problems are solvable. I am just as convinced that they are getting harder to put off. DLA Piper’s latest annual GDPR survey found that personal data breach notifications across Europe rose sharply in the year to January 2026. In South Africa, the Information Regulator recently briefed the media on high-profile enforcement cases and investigations under POPIA and PAIA. And the EU has now confirmed in law when its rules for high-risk AI will apply. Each of those ends up as a question from an auditor, a regulator or a board. The organisations that answer it well will be the ones that started building a programme they can prove before anyone asked.
Barry Curtin
Chief Executive Officer, PrivIQ