The Privacy Capability Framework
Privacy capability is not the same as knowing the rules or producing the right artefacts. The framework distinguishes four levels of practitioner capability and the organisational conditions that allow that capability to develop, plateau or be suppressed.
Capability is a property of the practitioner and the structure around them.
The four levels
- Rule Knowledge
- Operational Fluency
- Risk-Disciplined Judgement
- System Shaping
The levels are cumulative, and the higher ones are not more privacy knowledge. What separates them is set out in the framework.
The structural overlay
The same practitioner can present very differently in different operating models. Role design, line placement, proximity to business decisions, authority and exposure can either develop capability or suppress it.
The useful question is therefore not only “What level is this person?” It is also “What level is the role asking them to operate at, and is the operating model giving that capability room to develop?”
From operational fluency to judgement
The framework identifies the move from Operational Fluency to Risk-Disciplined Judgement as its critical transition. More training alone does not reliably create it. The transition requires exposure to real operational decisions and structural conditions in which judgement can actually be exercised.