In this episode I have the privilege to chat with the ex Information Commissioner to the United Kingdom, Richard Thomas. Richard explains the challenges that he and his team faced around awareness, behaviour and culture and also his thoughts around what good awareness, behaviour and culture might look like from a regulators perspective when assessing an organisation who has been reported to the regulator for a breach in security around personal data.