By Kirsten Krook, Privacy Officer at Hanze – University of Applied Sciences (Groningen)
As a Privacy Officer at a higher education institution, I spend much of my time discussing policies, procedures, risk assessments and compliance requirements. These are all important elements of a mature privacy programme. Yet over the years I have come to realise that privacy is not only a legal or technical challenge. It is also a behavioural one.
The more I learned about human behaviour, the more I recognised a familiar pattern in privacy: people rarely make poor choices because they intend to. Instead, incidents often occur during ordinary moments; when people are busy, distracted, trying to be helpful, or simply following established routines.
If privacy risks often emerge from everyday behaviour, could meaningful improvements also come from small changes in everyday behaviour?
Knowledge + skills + motivation ≠ action
Awareness of privacy has improved significantly over the years. I started by sharing loads of knowledge and crossing my fingers colleagues would do as they were told. Most people understand that personal data should be handled carefully. They know they should share information responsibly, lock their screens, limit access where appropriate and protect sensitive information. But knowledge, skills and motivation alone does not guarantee (changed) behaviour.
I rarely encounter colleagues who deliberately ignore privacy rules. More often, people are trying to get their work done. They are helping a student, answering a colleague’s urgent request or rushing to meet a deadline. In those moments, privacy can easily become a secondary consideration.
Privacy happens in small moments
When organisations discuss privacy, the conversation often focuses on major initiatives: new policies, mandatory training, compliance programmes or technical safeguards. These measures are valuable. However, privacy is ultimately realised through thousands of small decisions made every day. Checking the recipient of an email before you click send, locking your screen before you leave your desk, not collecting more information than needed, etc. None of these actions takes more than a few seconds. Yet I’ve seen enough incidents over the years to know that many problems start when one of these small steps is skipped. This is where the idea of ‘small habits, big impact’ becomes relevant. Sustainable behavioural change is rarely the result of one major intervention. More often, it is the accumulation of small actions repeated consistently over time.
From awareness to behavioural change
Many awareness campaigns are built around a simple assumption: if people understand the risks, they will change their behaviour. From a behavioural science point of view, it’s more complex than that. People do not always make deliberate decisions. Anyone who has ever sent an email and immediately realised they forgot an attachment has experienced this; we often act before we consciously think. Privacy-related decisions are no different. Much of our behaviour is automatic and influenced by habit, convenience, environment and social norms.
For privacy professionals, this means that creating awareness is only part of the solution. More important is designing environments that make the desired behaviour easier. Instead of asking: “Do people know what they should do?” and overload them with more information if they don’t, we should also ask: “How easy is it for people to do the right thing?”.
If privacy-friendly behaviour is difficult, complex or time-consuming, awareness alone will not overcome those barriers. Small adjustments to processes, systems, surroundings and workflows can often have a bigger impact than another reminder about the rules.
The influence of social norms
One of the most powerful lessons from behavioural science is that people are strongly influenced by those around them. In an organisation, behaviour is contagious.
When colleagues consistently demonstrate good privacy practices, others are more likely to follow. When managers visibly take privacy seriously, employees perceive privacy as an important organisational value. When teams openly discuss lessons learned, privacy becomes part of daily professional practice rather than a compliance exercise.
But the opposite is also true. If shortcuts become normalised, those shortcuts quickly spread through the organisation. This means that privacy culture is not built through policy documents alone. It is built through visible behaviours that signal “how things are done around here”.
Rethinking the role of the Privacy Officer
Traditionally, Privacy Officers are expected to advise on legal requirements, assess risks and support compliance efforts. Those responsibilities remain essential. However, I increasingly see another dimension of the role: helping organisations understand and influence behaviour.
Rather than focusing exclusively on what people should do, we can also explore why they behave the way they do. We need to get to know our target audience. We can identify barriers, simplify processes and encourage habits that support privacy-friendly decisions.
In other words, privacy professionals can help create conditions in which good privacy behaviour becomes the easy, obvious and normal choice.
Small Habits, Big Impact
Higher education institutions are complex environments. Thousands of employees, researchers and students interact with personal data every day. No Privacy Officer can oversee every decision or prevent every mistake. I don’t think privacy requires perfection. It requires a commitment to small consistent behaviours. When they are repeated across the organisation, every day, their impact becomes significant.
Privacy is often associated with regulations, governance and compliance. Those things matter. But lasting change happens through people. After several years working in privacy, I’ve become less convinced that every problem can be solved with another policy or another awareness campaign. Often the biggest improvements come from much smaller interventions: making the secure option the easy option, creating useful reminders or simply having the right conversation at the right moment.
About the author
