Having more than 35  years in Business Process Management, Change Management, Data Governance, Data Protection,  Software Development, Business Intelligence, Risk Management, Quality Assurance, and Internal Audit, but also Project and People Management.
Passionate for Cross-functional, inter-disciplinary projects, addressing systems, technology, processes, people, and data across all functions of an organization, to run efficiently supporting the organization’s goals.
In the last 7 years, performed consulting engagement and fractional DPO roles for various companies – SMEs and large corporations, NGOs, and Public Administration, across various industries/sectors. "
Due to my preference for cross-functional projects, aside from my specific domain, I got trained/ certified(*) and have practical experience in implementing various international methodologies and frameworks in different domains - COSO, COBIT, ITIL, ISO 27001, NIST, CMMi, PMP, Prince 2, TQM, Lean, Six Sigma, SoX, BPM, GRC, ISO 9001, ISO 19011, ERM, ISO 31000, TAM/eTOM/SID…and few others.
*Note: no certification is maintained anymore, so please don't ask for credentials

You can contact me for discussions on mobile, email, or through LinkedIn messaging
Mobile: 0723 250 333
email:   daniel.suciu@gmail.com

For specific work inquiries, you can find me (and my colleagues) in the Data Protection City here:
 https://dataprotection.city/

Exemplul perfect care arată cum societatea românească face cu boltă pe principiile protecției datelor (AKA minimizarea datelor)
 
Subsemnat(a/ul) ..............................., domiciliat(ă) la adresa ................................... , localitatea …………………………., județul ……………………….., țara ……………………..,
născut(ă) în localitatea ………………., județul …………….., în data de ……………., 
identificat cu act de identitate (CI/BI/ Pasaport) seria ….…, numărul……………..., eliberat de către……………….., la data de………..,  valabil până la ……………………, CNP …………………………
vă rog să….
 
Data ....................                                     Nume, prenume ...............................
                                                              Semnătura ..........................................
 
Sunt cel puțin 3 forme diferite de identificare (4 când se face o copie a actului de identitate), fiecare fiind absolut suficiente (conform unor legi specifice în diverse domenii, nu doar a bunului simț), pentru identificarea unei persoane, unele conținând ele însele informații redundante/ irelevante.
(la care se mai cere uneori și o copie a actului de identitate... la fiecare interacțiune, evident).

Nu mai zic că nu rareori se cere completarea manuală a informațiilor, chiar dacă datele există în sistemul IT intern al organizației.

În cazul unei bănci a fost chiar și mai tare: s-a cerut numărul de abonat al clientului (pe baza căruia poate fi identificat orice client), plus validarea unui card al băncii, dar cererea tot trebuia să conțină acele informații.

Mai mult decât asta, la puțin timp mi s-a comunicat că trebuie să-mi actualizez datele personale (îmi schimbasem cartea de identitate). Evident că cele completate de către mine în cerere nu au fost preluate în sistemul intern.... că nu am cerut, deși operatorul le-a introdus minuțios într-o aplicație, că doar nu puteau rîmâne doar pe hârtie... iar actualizarea necesita (evident) prezența mea fizică.
 
BTW, nu e aplicabil doar la stat, poate chiar dimpotrivă, unele instituții chiar limitându-se la a cere mai puține informații, ci și la societăți comerciale, inclusiv (sau mai ales) mari firme multinaționale.

No, trăiască GDPR-ul și ”experții” care-i consiliază pe aceștia (pe bani buni de obicei) 😁 
BTW, nu dați în DPO, că pe el(ea) nu îl(o) întrebă nimeni dacă e corect 😇

Daniel SUCIU

Data Protection/ Management / Governance & AI dude | Engineer by background, Entrepreneur/Intrapreneur by choice | Proud dad of 2 daughters | Human Being by design and by default

Minimizarea datelor cu caracter personal în societatea românească

My strengths as a consultant... and why these matter>

Leaving modesty aside, I should also highlight my (perceived) strengths, so here they are, in a random order. BTW, some of them were also presented as weaknesses, but I see no contradiction - a weakness for some could be a strength for others.

I’m not a lawyer … nor just an engineer. Background is not all, learning and experiences matter more. It matters because I invested 1000+ hours to read laws, authorities' recommendations, court cases, and articles on the topics I was interested in;

Worked 30+ years to implement real processes (and tools) in different domains, being in operation long after I left the projects. It matters only if you want to implement changes in your operational processes;

I don’t rely on „relevant” certifications… just on experiences and continuous learning. I don’t pretend to be an expert, just a curious and passionate professional. It matters because I can say “I don’t know” and finding the right answer/ people who know;

Strongly disliking bullshit, so I’ll never use it. No moral compromises. Mutual trust is a pre-requisite, but is has to be gained. I’m sure you don’t need a reason why it matters;

100% independence, but not objective. My open opinions come from experience/ learning, not interests. It matters because I will actually be looking at your interest only;

I’ll always tell you what I believe you need to hear, not what you want to hear. It can be unpleasant sometimes, but also useful;
I hate Compliance… except when it’s the result of good Governance. It will take longer, but also last longer;

I don’t consider experience as a matter of years, but a matter of projects – accomplishments and failures. Past experience can find a good use in your specific case;

I’m a very curious guy and motivated to learn continuously. At least I’ll try to understand your problems and we can learn together;

I was lucky to build a network of professionals from many domains, backgrounds and cultures. When I don’t know something, I can always read, discuss and ask.

As for my weaknesses (which can be found in the first comment), the list is open 😁. Any feedback will be highly appreciated, especially constructive feedback. 

Thank you,
Daniel Suciu / unCommon Sense Advisory

My strengths as a Consultant /consultancy business

Let’s see how cybersecurity, anti-phishing trainings and data protection policies apply to HR/ Recruitment (part 1)
 
Me (to HR manager): Did you read the cybersecurity policy, and did you attend the anti-phishing training? HR: Of course, we all did. Me: I suppose the same happens with Data protection. HR: Of course…

Me: and you’re respecting those rules, right? HR: of course. We all have to…

OK, so let’s take some examples:

-         Me: It’s written here that you should not open emails from unknown sources. May I see your inbox? Who is MariaS @yahoo.com?  HR: a candidate. Me: Did you know her? HR: No, how should I? Me: So, it’s an email from an unknown source and could be a security threat. HR:  like another 1000 emails 😁.

-         Me: Then it’s written that you should not open a potentially harmful document. It has attachments. You did open them, right? HR: Of course, as these are the CV and the intention letter, as requested by us. 

-         Me: What about clicking on suspicious links, like this one on <myportfolio .tv>, from the same email? HR: It’s her portfolio, obviously... Me: You suppose it is what she said...

-         Me: Another hint to identify suspicious email are typos and a false sense of urgency. Have you found some? HR: :... except emails from management and hiring managers, not quite 🤪  (please keep this out of the record). Me: I worked in corporations for 20+ years, so I understand you well.

-         HR: These rules should not be applicable to us regarding recruitment. Me: I know, but it is not written anywhere...
 
-         Me: OK, today we finished the anti-phishing policy and training. Tomorrow, we'll address some general cybersecurity and data protection rules.

Sounds familiar? 😇

Specialist in Business Process Management, Change Management, Data Protection, Data Governance/ Management/ Quality, Software Development Life Cycle, Risk Management, Quality Assurance and Internal Audit, but also Project and People Management, with measurable results at the intersection of systems, technology, processes, people and data. 

Experienced working between business and IT/technology, between customers, internal stakeholders and partners/ suppliers, but also between executives and line management or between line management and execution level employees. 

Manage, coordinate and support change management and process improvement which helps people support the business, getting hands dirty when needed – and it always does. Continuously challenging the status quo and taking care to external challenges and opportunities. 

Learnt to use diverse frameworks and methodologies on business, SDLC, system engineering, quality, process and data governance, information security, risk and compliance (eTom, SID, TAM, INCOSE, PMP, Prince, CMMI, ITIL, ISO 9001, Lean, Six Sigma, COSO, COBIT, 3LoD, GRC, ISO 27001…) as a way to reach business goals, to add value to business, not as a break for innovation or efficiency, or as buzzwords to impress stakeholders.

How I see myself? Curious, even enthusiast, self-motivated, open minded, loyal, dedicated and result driven, but also capable of delayed gratifications, required by any long time initiative, but most of all believing in honesty, work ethics, loyalty, respect and trust as a basis for any activity;

Want to know more about me? Read some of my last 500 posts :) ... or just call me. preferably now, tomorrow could be too late.

Mobile: 0723 250 333
email:   daniel.suciu@uncommonsense.ro
or through LinkedIn messaging




Corina BORZ

Weaknesses as a consultant... and risk treatment for each

Context: This year, I’ll start the preparation for my full-time comeback to Consultancy, estimated in three to four years.
See initial post in first comment.
 
Weaknesses (in a random order – with one exception 😁 ):
-         I’m not a lawyer - Risk treatment: Accept ( no explanations needed);
-         I don’t hold „relevant” certifications (and I never will, giving up maintaining the dozens of certifications I have obtained) - Risk treatment: Avoidance ( no engagement with any potential customer, considering this as a pre-requisite);
-         My age/nationality (still relevant in many cultures) - Risk treatment: Avoid ( No explanations);
-         My informal style and sometimes colorful speech - Risk treatment: Accept (Excellent way to select my potential customers);
-         My open critical opinions  - Risk treatment: Accept (Excellent way to select my potential customers);
-         Outdated knowledge in some areas of former expertise - Risk treatment: Mitigate (using partners in every area I cannot master – BTW, IT included);
-         I’m too small for large/important projects- Risk treatment: Transfer (recommend trusted providers, even when I cannot be involved);
-         I cannot accept work for companies/ projects I don’t believe in - Risk treatment: Avoid (no explanations needed);
-         Never willing to accept moral compromises and/or being an accomplice in illegal processing of data- Risk treatment: Avoid (no explanations );
-         I use to tell my potential customers the difference between their expectations, their requirements, and their needs, as perceived by me - Risk treatment: Accept ( no explanations);
-         I don’t pretend to be an expert, even in the domains where I have expertise (not by years but projects/results);
-         I have no budget for marketing, and I don’t intend to have one - Risk treatment: Mitigate (continue to use Content Marketing/ Awareness and referrals as my only marketing means);
-         I’m perceived as a one-man show business, even if I collaborate with other specialists, or decline and recommend others when I feel is too much for me - Risk treatment: Mitigate (try to build a small public network of partners);
-         I refuse any discussion on a possible contract requiring to write bullshit documentation to „justify” current processes - Risk Treatment: Accept (no explanations).
 
BTW, the list is open. 
These are only the weaknesses I have identified in a short time, considering mostly my perspective, even if some feedback from others was included. Please help me enrich my list :D
I appreciate your feedback, here or through DM, whichever you would consider appropriate. I promise to take it personally, meaning with gratitude for your help, trying to analyze, understand, and respond to any feedback.

Daniel SUCIU / unCommon Sense Advisory

When the data protection/ information security incident list is empty... 
Short story: A data protection & Information Security audit at a large anonymous company
 
Me asking for the incident register. Empty.... Company: We didn’t have any data breach. Me: but incidents? Company: none. Me: right...

Me: Did you have stolen, damaged, or lost business phones or laptops? Company: We had a few cases, but nothing was stolen... Me: As far as you know. Did you investigate? Company:...

Me: Can you see the area where you are keeping the faulty IT equipment? So, some are retired, some are waiting for repair, and some are just waiting for a new owner. Can we check some to see if these contain data? They do? You didn’t have time to erase the data. Right, including these, waiting for your external partner to fix...

Me: Can I see the history of the alert notifications of your sysadmins? Let’s select just the critical assets. How would you explain the thousands of alerts which look at not even opened? Just warnings? How about these critical failures on message 2532, 3746.... ? Company:...

Me: Let’s take a look at the backup error messages. What are these failure alerts? Company: It happens from time to time due to resource conflicts and poor connectivity, but these are all fixed. 
Me: Even those that are in the initial status and not formally closed? Did you investigate? Company:...

Me: You have a nice, detailed backup and restore policy. Let me see the latest restore results. OK, thanks, but I was not talking about those recovery activities when you needed some data, but some of the planned restore activities for critical systems data. I understand, you didn’t execute them because you had no incidents on back-ups (except those untreated alerts, including critical failures), but you „know” the data is there, complete and accurate. Right...
 
Company: We had cybersecurity audits from three Big4 auditors, and none of them mentioned these... Me: Seriously 😁 ? 
 
Episode 2, a little later...

Lessons Learned … from a business perspective [lesson 1]

As I said before, this year I’ll start the preparation for my full-time comeback to #Consultancy, estimated in three-four years. Meanwhile it will be just a part time activity, in parallel with learning, preparation and further developing my network… and partnerships.
 
 
So, first lesson I learned (as a #consultant, from a business perspective) is:
Never, ever respond to a RFP (Request for Proposal] 
Nor give a detailed approach of your solution, mentioning actions and deliverables . 99% is a trap
Why I’m saying this?
Because I have seen it way too many times. The most common outcomes are:
-         it’s just a justification for rating another offer as the best, an offer which was already decided it is the best, due to personal interests or any other reason. According old practices they need three offers;
-         They are just picking your brain. They have a selected partner, but this doesn’t know exactly what to do;
-         They are just picking your brain for another reason: they want to do it internally, but don’t have enough knowledge;
-         Finally, there are honourable good intentions from those who send it to you, but they are not the decision makers;
-         …
-         OK, there is the possibility to be real and you could be the winner, but you can also win the lottery, right?

My previous posts on assessing my (perceived) weaknesses, strengths and differentiators (as a business) can be found in my first comment.

Please feel free to add on any of them. Your opinions really matters for me. I promise to honestly analyse any feedback I would receive… if any

taplio

Daniel SUCIU's Linkedin Analytics

Daniel SUCIU

Performance ScoreDaniel SUCIU's LinkedIn Performance

Daniel SUCIU's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Daniel SUCIU's Linkedin Analytics

Daniel SUCIU

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Daniel SUCIU's LinkedIn Performance

Daniel SUCIU's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Daniel SUCIU's Linkedin Analytics

Performance ScoreDaniel SUCIU's LinkedIn Performance

Daniel SUCIU's Best Posts (last 30 days)