Flashback to April 2009 for a moment. U.S. President Barack Obama was at the tail-end of the first 100 days of term number one. The North Carolina Tar Heels crushed Michigan State to win the NCAA Men’s Basketball Tournament, and the Black Eyed Peas’ “Boom Boom Pow” began its domination of the Billboard 100 charts.

It was during this time when Chris Zoladz, CIPP/E, CIPP/G, CIPP/US, CIPM, CIPT, founded Navigate, a boutique consulting firm that provides advisory services to help organizations manage risk and meet compliance requirements.

A decade later, Navigate and Zoladz continue to work with their substantial client base, many of which are Fortune 500 companies. While the nature of Navigate’s work has not changed much over the past 10 years, Zoladz said, the nature of the privacy issues it faces have changed dramatically.

“It has been an action packed 10 years,” Zoladz said. “It feels great to be at the end of the first decade. We think for us, as well as privacy in general, that the best days are ahead. This is still a very much evolving and also increasingly complex area and also increasingly more strategic importance for organizations than it has probably ever been before.”

Zoladz said Navigate's core services have not changed much since its early days in 2009. Asked about the evolution of his firm, Zoladz pointed to the technological surge since Navigate's inception and the challenges that have arisen from the swell.

“Ten years ago, there weren’t discussions with clients about big data, artificial intelligence, facial-recognition technology, autonomous vehicles, smart cities and stuff like the internet of things,” Zoladz said. “I think over the last decade the complexity of the issues has been what has evolved. It has challenged everybody to understand how the technologies work and how to be able to effectively use those technologies in privacy-sensitive ways.”

Zoladz has seen other shifts in privacy, not only from when Navigate launched, but also from when his career itself started 20 years ago. Zoladz said compliance was the main focus for U.S. companies, with the focus centered on rules such as the EU Data Protection Directive. Since that time, Zoladz points to the proliferation of privacy-related stories reported by the media and how that has broadened companies’ outlooks to focus on more than just compliance. 

With all the changes in privacy, Zoladz said his firm puts an emphasis on “continuous learning.”

“What makes this field exciting it that it is changing so quickly, and there are new issues all the time. From a technology perspective, whenever there is a new technology that is being adopted or considered that has privacy implications to it, then we have to become quick studies on that, whether it’s either documentation, studies or guidance that's published by NIST or anybody else for that matter,” Zoladz said.

Navigate has been able to succeed as a boutique firm, but Zoladz knows many others have not been not as fortunate. He has seen plenty of boutiques come and go over the past decade and over that time has been able to identify the reasons why firms have not been able to sustain their practices.

He said the number-one challenge for boutique firms is to generate the business necessary to support multiple people and deliver services clients want. There is also a level of financial uncertainty that boutique staffers have to go through. Consulting can come with periods of time when employees may not be certain about the status of a paycheck.

“You really never know for certain where that next engagement is coming from and what the size it is going to be,” Zoladz said. “You have to be in a situation in your life where you can live with some degree of variables, versus when you are working internally in a corporation where you know your salary and your bonus and you have health care and a 401(k).”

That naturally begs the question: Why would Zoladz choose the boutique route? Well back before Navigate opened its doors, he worked for Marriott. He always wanted to go into business for himself, but in his own blunt words, “never had the guts to do it, and therefore I didn’t.”

As Marriott underwent changes, Zoladz found himself realizing it was “now or never,” and he started to make the connections needed to make Navigate a reality. Those connections came from a strong network he had already developed within the privacy community.

“Had I not been involved with the IAPP from the beginning, had I not had as broad a network of professional contacts and colleagues as I had, I don’t know if I would have gone this route, because I knew, and still believe, that no organization is going to do a Google search for privacy consulting services,” Zoladz said. “That’s not how these services are purchased. These services are purchased by individuals who want to know the people they are buying them from, and they want to trust the people they are buying them from.”

The firm has seen a rise in activity over the last 18 months thanks to the EU General Data Protection Regulation. Now, the California Consumer Privacy Act is on the horizon with the potential of a federal U.S. privacy law lurking in the background. Zoladz sees these developments as reasons why he believes Navigate will have a strong second act.

“The regulatory environment is going to get more demanding and challenging, whether here in the states through a patchwork of various state privacy laws that are lookalikes or similar to CCPA, or a federal privacy law, which I think would be a good thing,” Zoladz said. “That is going to create, just like GDPR, requirements that don’t exist today, and that is going to create work that is going to need to be done and  companies that are going to need help doing that work.”

Photo by Tim Mossholder on Unsplash.