Overview
Irina Klokova is based in Brussels, where she co-founded the European Data Compliance Network EUDCN in October 2023 and sits on its board. Since August 2019 she has also been a partner at Navigator Consult, and between October 2020 and December 2023 she served as a board member of DPO circle. She gives her expertise as change management.
From January 2012 to May 2019 she was manager of the Bureau de représentation de INTER RAO UES sur le territoire du Royaume de Belgique. Earlier she spent close to a decade at Citi, heading CitiLeasing OAO from 2001 to 2002, working as project manager for the EMEA office from 2002 to 2007 and as marketing manager until October 2010. She worked in the investment banking department of JPMorgan Chase from 1999 to 2001, in the fixed income department of Credit Suisse First Boston from 1995 to 1999, and in corporate banking at ING Belgium from 1993 to 1995.
She studied economics at Lomonosov Moscow State University, took an Executive MBA in general management at Hult Ashridge Executive Education, completed the Chef de Projet IT course at Technofutur TIC and the programme in European data protection and GDPR at Solvay Brussels School of Economics and Management, and is enrolled in Applied Agentic AI for Organizational Transformation at MIT Professional Education in 2026.
Career history
In the news
- Promoting to my friends from Berlin and around my daughter's film festival
- This week I attended the CIO Benelux 2026 summit organised by Citrus Events. The best part was the mix of industries in the room: retail, automotive, government, mobility, financial services. Different sectors, same questions underneath: AI adoption, supply chain exposure, digital sovereignty, operational resilience. The friction points facing modern CIOs are now critical enterprise-wide risks. Technical decisions are governance decisions. Boards simply cannot afford to treat IT, risk, and operations as three separate conversations
- Very often the question "How do we make money with AI?" comes down to speed. "We automated our client proposals. It used to take four hours to write the quote. Now it takes 30 minutes". Sounds great on paper. Until you look at the rest of the timeline. The draft takes 30 minutes. Then it waits 36 hours for a senior manager to approve it. All the AI did was rush the work to the exact same bottleneck. Two things organisations tend to miss: ☑️ First, paying for a subscription is not the same as buying expertise. While you spend less
- Very often the question "How do we make money with AI?" comes down to speed. We automated our client proposals. It used to take four hours to write the quote. Now it takes 30 minutes. Sounds great on paper. Until you look at the rest of the timeline. The draft takes 30 minutes. Then it waits 36 hours for a senior manager to approve it. All the AI did was rush the work to the exact same bottleneck. Two things organisations tend to miss: ☑️ First, paying for a subscription is not the same as buying expertise. While you spend less time
- I am thrilled to join the Belgian Cyber Security Coalition as an Associate Member. Navigating EU digital regulations, AI governance, and IAM requires deep cross-industry collaboration, and I look forward to actively contributing to the Focus Groups and exchanging insights with fellow members.
- ISO 27001, the standard most GRC programmes are built on, assumes a living management system: records reviewed regularly, clear owners, clear escalations. Large enterprises run that with dedicated teams and consulting budgets. Everyone else writes the documents once, passes the audit, and gets back to work. This is where AI can help a leaner organisation, though not by replacing the fundamentals. It takes on different chores: - in Process, it maps what is actually running and keeps that picture current - in Governance, it
- A business changes every week. The records we use as proof (the RoPA, the DPIA, the vendor register, the AI inventory) cannot stay static. Each needs an owner, a current state, and an invalidation event: the exact change that makes it untrue. Not every change should stop the work. Systems shift constantly: pipelines get tuned, schemas shift, IP addresses rotate. If every tweak needed fresh approval, delivery would stall. The line must be drawn clearly between two things: 🔹 Routine changes update the record, nothing else 🔹 Material
- Continue on the subject. The warning bell rang back in 2018 when GDPR started to apply. A meaningful RoPA or DPIA was never meant to be a legal brainstorming exercise. Both depend on discovery: understanding what data exists, who touches it, which systems store it, and how it flows across the organisation. Most organisations took the shortcut instead. They bought generic templates, filled in spreadsheets to pass an audit, and filed compliance away as a closed project. What they documented was what they hoped was happening, not what
This page shows public professional information only, each fact cited. Is this you? send a correction, or ask for removal within 24 hours, no questions asked.