# Building a Scalable Vendor Assessment Process (GDPR & NIS2) | Natalija Bitiukova

Page: https://stenobird.com/podcast/practical-privacy-with-orla-dormer-7667648/building-a-scalable-vendor-assessment-process-gdpr-nis2-natalija-bitiukova
Text version: https://stenobird.com/podcast/practical-privacy-with-orla-dormer-7667648/building-a-scalable-vendor-assessment-process-gdpr-nis2-natalija-bitiukova.md
Podcast: [Practical Privacy with Orla Dormer](https://stenobird.com/podcast/practical-privacy-with-orla-dormer-7667648)
Published: 2026-05-12T05:45:02+00:00
Episode link: https://www.spreaker.com/episode/building-a-scalable-vendor-assessment-process-gdpr-nis2-natalija-bitiukova--71852478
Audio file: https://api.spreaker.com/download/episode/71852478/natalija_bitiukova_full_episode.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/practical-privacy-with-orla-dormer-7667648/episodes/building-a-scalable-vendor-assessment-process-gdpr-nis2-natalija-bitiukova
Duration seconds: 500

## Resource

Building a scalable v endor assessment process sounds straightforward—until you’re dealing with 50,000+ vendors across 40+ countries.In this episode, Natalija Bitiukova (Head of Data Protection & Digital Law at Carlsberg) shares how her team tackled this challenge in practice, moving beyond fragmented systems and “paper compliance” to a more operational, scalable approach.We discuss: The pitfalls of running privacy and security assessments separately Why most vendor assessments fail after the questionnaire stage How to simplify assessments for real users (not lawyers) The importance of data quality and realistic resourcing Change management in large, decentralized organisations Getting leadership buy-in by framing compliance as a business issue A practical conversation for anyone working on vendor risk, GDPR , NIS2 , or scaling compliance processes. About the podcast: Practical Privacy explores how privacy and security teams solve real-world challenges at scale. Brought to you by TrustWorks https://www.trustworks.io/

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/practical-privacy-with-orla-dormer-7667648/episodes/building-a-scalable-vendor-assessment-process-gdpr-nis2-natalija-bitiukova/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/practical-privacy-with-orla-dormer-7667648/building-a-scalable-vendor-assessment-process-gdpr-nis2-natalija-bitiukova.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.