I came into this with a Law and Business Management degree, which is to say not a technical one. Fifteen years later I've done Big 4, then compliance, privacy and then data governance. CIPP/E qualified a whole bunch of certificates i collected along the way and passed the Legal Practice Course. Happily married with kids. Currently based in the UK.
The part people don't expect is that I've done this more than once. Assurance, then compliance, then internal audit and data governance, 1st line, 2nd line, 3rd line, learning the machine from every seat before I picked the one I wanted to build a career around. Each move was a deliberate pivot, not a lucky break.
Here's what those fifteen years actually taught me, and it isn't what I thought I'd learn.
These days the work has a newer name. The IAPP calls it privacy, AI governance and digital responsibility, which is a mouthful, but it captures the shift: data protection and governance are no longer separate from what happens when AI gets pointed at the same data. That overlap is where I spend my time now, and it's what I share as I learn it.
I spent years believing hard work alone would get me there. It doesn't. What does is making sure the few things that genuinely move you forward take the lead, instead of drowning in the fifty things that don't. That's most of what I write about now.
The other part is AI, and I use it the way I'd want anyone to use it. Not collecting tools. Not learning prompting as a hobby. Working backwards from something I actually need done, and finding the shortest route to it. I love being productive, specifically, I love ticking things off a list when the things on the list are the ones that matter. Half the value of AI, for me, is that it clears the noise so I can get to those faster.
I'll also tell you the unflattering part, because it's the reason half of what I make exists. I've started plenty of things and quit them, not because they were bad ideas, but because they were slow, and slow felt like proof I'd got it wrong. Learning to stay with one thing long enough for it to work is the hardest skill I've had to build, and it's the one most people actually need.
I'm not going to tell you any of this is easy. It wasn't, and I'd be lying. But it is learnable, and most of it is more specific than the advice you've been given.
Two kinds of people.
People trying to get into data protection, data governance, compliance or AI governance, usually from a role that already touches the work, without the words to prove it. And people who trying to figure out what they want, and need the goal cut down to a step small enough to start tonight. The finish lines differ. Naming the one move that matters and clearing everything else out of the way doesn't.