Priya Mehta has spent 15 years thinking about what it means to handle data that people never wanted anyone to have in the first place. As Chief Compliance Officer at Zenith Health Group — a private healthcare provider operating across the UK, Germany, the Netherlands, France, Ireland, and Spain — she oversees compliance for 4,200 employees and a data estate that includes everything from GP appointment records to longitudinal clinical trial datasets.
Q: Your path to CCO wasn't a straight line. You trained as a pharmacist before moving into compliance. How did that shape the way you approach your role?
A: It shapes everything, actually. When you've worked as a pharmacist, you understand in a visceral way that data about someone's health is not an abstract thing — it is intimately connected to their identity, their relationships, their fears. A blood test result isn't a row in a database; it's something a person may have been dreading for weeks before they got it. That perspective makes me impatient with compliance frameworks that treat data protection as a tickbox exercise.
Q: Let's talk about clinical trials specifically. GDPR treats health data as a special category, but there are also specific provisions for scientific research. How do you navigate that tension in practice?
A: This is genuinely one of the most complex areas I work in. The UK GDPR Article 9(2)(j) exemption for scientific research sounds broad on paper, but it comes with conditions — appropriate safeguards, data minimisation, pseudonymisation where possible — and in practice, those conditions require continuous interpretation, not a one-time legal sign-off. We had a situation two years ago where a participant in a multi-site trial submitted a data subject access request mid-trial, and fulfilling it comprehensively would have required us to disclose to that person information held by three different data processors across two jurisdictions. Working out the choreography of that response took four weeks and involved our DPO, external counsel, and the trial sponsor's legal team.
Q: Data subject access requests for health data — what does good look like?
A: Good looks like a process that takes the rights seriously rather than treating them as an adversarial inconvenience. At Zenith, our target is to acknowledge every DSAR within 48 hours and to complete straightforward requests within two weeks rather than the statutory month — not because we're trying to be heroes, but because a timely, complete response builds trust with patients in a way that matters commercially as well as ethically.
People ask me what keeps me up at night, and the honest answer is: it's not the big, obvious risks. It's the quiet assumptions — the places where someone has decided that a particular data flow is fine because it always has been, and nobody has looked at it carefully in three years.
Q: Post-Brexit, the UK is operating under UK GDPR rather than EU GDPR. For a company like Zenith with operations in both the UK and the EU, what does that mean practically?
A: It means running two parallel compliance programmes that are closely related but not identical, and managing the points of divergence carefully. The UK GDPR adequacy decision from the EU has been renewed, which gives us some stability. The ICO has been moving toward a somewhat more risk-based, less prescriptive approach compared to the EDPB, which I actually find workable, but it requires more judgment and documentation.
Q: Building a compliance culture with medical staff is notoriously difficult. How do you approach that?
A: By accepting that they're not entirely wrong. If a compliance requirement is genuinely getting in the way of good patient care, then the requirement — or the way we've implemented it — needs to be examined. The approach I try to take with clinical staff is to start from their concerns rather than from my framework. If I can answer those questions in language that connects to how they think about their work — patient safety, professional duty, doing right by the person in front of them — then compliance becomes something they understand rather than something imposed on them from outside.