Latest / Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance / Promoting Consulting Business Through Content Marketing | Interview with Punit Bhatia

Transcript

Promoting Consulting Business Through Content Marketing | Interview with Punit Bhatia · Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

• 0:00
  Dejan Kosutic: Welcome to Secure and Simple podcast. In this podcast, we demystify cybersecurity governance compliance with various standards and regulations and other topics that are of interest for consultants, and other cybersecurity professionals. Hello, I'm Dejan Kosutic and I'm the host of Secure and Simple podcast. Today my guest is a very interesting person. His name is Punit Bhatia and he's the founder of Fit 4 Privacy Consulting Company, the author of four books on GDPR and is also the host of Fit 4 Privacy podcast.
• 0:37
  Now, being one of the leading experts in privacy regulations, he's also using content marketing in a very, very skilled way. So in today's podcast, you'll learn some of the best practices on how to promote a consultancy by creating various expert materials. Welcome to the show, Punit.
• 0:58
  Punit Bhatia: Thank you so much, Dejan for having me. It's a pleasure to have this with you.
• 1:02
  Dejan Kosutic: So can you tell me how did you start your consulting career? How did you really enter into this consulting business?
• 1:10
  Punit Bhatia: I would say pure coincidence, magic and luck. That's how it goes.
• 1:15
  Dejan Kosutic: I mean, back
• 1:16
  Punit Bhatia: in I started my career in 1999 and till 02/2014, even to an extent in '15, I had no clue I'll be doing consulting and business. Many people asked me when I did my MBA. They said you should, and I was not interested. But then a few things turned up. I was the top talent in the bank, and all of a sudden, things didn't go well.
• 1:41
  And I was on verge of being fired. And then I hired a coach, and he said
• 1:46
  Dejan Kosutic: Mhmm.
• 1:46
  Punit Bhatia: Why don't you set up your own business? I said, no. That's not the thing I want to do. I didn't listen to him, and but he advised me to read books and grow yourself and improve yourself as a person. So that thing stuck me, and I started listening to books.
• 2:02
  So and then a few books said, you should improve, improve, improve, and then said, you should become a person of influence inside the company or outside. And then I came across a book called key person of influence. It should say it said you should write a book. You should speak at events. I started doing that.
• 2:21
  And what happened is as I started doing that, my company got uncomfortable again. So it was not fired. I managed to stay in. But now with my new actions, they got uncomfortable. And as they got uncomfortable, I got more comfortable saying, if you don't feel comfortable me finding something, and then all of a sudden, few years ago, you wanted to let me go.
• 2:43
  I'm not comfortable staying with you. And then the seed of this being independent, being consultant started. And around 02/2008 so I set up a independent contract more to write books in 02/2017, I believe. And then two years later, I set up my company, and I quit my job. And then I started or rather I was I quit my job, then I joined another job which would who would allow me to do the business.
• 3:12
  And then they fired me during corona times. And then I said, okay. Now everything is lining up. Let me give it a shot. Let me try it.
• 3:21
  And then since then, it's been going well. There are ups and downs. There are challenges less just like there are in the job. And since then, I'm a consultant. But ten years ago, if you ask myself, I want to be a consultant or a business, no way.
• 3:37
  Dejan Kosutic: So did you regret now that you're a consultant?
• 3:40
  Punit Bhatia: No. I rather am very happy that those events happened and they led me to this situation.
• 3:46
  Dejan Kosutic: Yeah. Yeah. It's very often I see this with the consultants. At the beginning they're very anxious if they will succeed and so on, but once they do, once they actually get into this comfort of actually being their own boss, then they actually like it a lot. I think this is one of the very best things about being an independent consultant.
• 4:06
  Yep.
• 4:06
  Punit Bhatia: Absolutely. I think what happens is you get a lot of freedom. Like you said, you be your own boss. You get a lot of freedom. And when you are an employee, you are bound by certain decisions or choices.
• 4:18
  What will this say? What will my boss say? Should I get an appraisal or not? And you are hindering yourself or constraining yourself. But as a consultant, you are all a free bird, and you say what you believe in, you want and rather, it's counterproductive.
• 4:31
  So people appreciate you for saying the right things.
• 4:34
  Dejan Kosutic: Yep, yep, yep. Okay, if I understood well, you were working for a large bank in Belgium, right?
• 4:40
  Punit Bhatia: Yes, that's
• 4:41
  Dejan Kosutic: correct. It was there, and you're also consultancies based in Belgium, I think. Correct. But the the your clientele, is it mainly European based or is it international? So the the
• 4:54
  Punit Bhatia: It's a mix.
• 4:54
  Dejan Kosutic: Who who do?
• 4:55
  Punit Bhatia: It's a mix. I usually go for a set of two or three categories of clients. So one is a Uh-huh. Primary client where I work eight hours a day. Mhmm.
• 5:07
  That can be project program management sourcing, privacy, AI, anything. Then the secondary client wherein I work few hours a week. Mhmm. So say fractional privacy officer, fractional AI governance expert. And then there are tertiary clients who are, like, need advice on an ad hoc basis.
• 5:27
  So when they need, they come back to me. I'm advising them on an ad hoc basis. So those are my clientele, and these are spread all over the world. Of course, the day job usually is in Belgium, Netherlands, or Luxembourg, you know, or in this European area, Rest of it is some of them are in US, some of them are in UK, and that's how it works. Mhmm.
• 5:47
  Dejan Kosutic: Great. Now how did you manage actually to get such a clientele? I mean, it's it's not easy to find clients, especially if you are, let's say, a foreigner in a country, you don't have, let's say, your friends that you've grown up with, so how did you manage actually to succeed in such a very competitive place?
• 6:08
  Punit Bhatia: I still don't understand, but I can explain you the things I did because there is a magic that works in this universe. Things happen and you need to do a few things. So I'm always blessed. There are some friends who say, come and work with me. Sometimes, there is a person who says he wants to work looking for an expert in this area.
• 6:31
  Would you like to talk? And I talk, and then it converts. And sometimes, of course, you do the hardcore sales effort, like approaching people on LinkedIn, not trying to do those things. But there's no magic formula because if I try any one of these asking friends, asking people to refer me, or approaching on LinkedIn, it doesn't work. But if you keep on doing that and keep on putting yourself up and saying, I'm available, I'm doing this, then somehow people connect with you, and it's the magic.
• 7:01
  So all that is needed is you are visible, and you're telling this is what I do. As long as that those two things are clear, then somehow people connect with you. But you cannot be sitting in your home and saying somebody will call me.
• 7:16
  Dejan Kosutic: Of course. I mean, you need to sell. Right? Even though that anyone everyone in in each business has to sell, even consultants. Right?
• 7:23
  And it's it's of course, the the the way to do it might be different, but, yeah, you always have to promote your business. So let let let's go to to this really main point. So how do you make yourself visible as a consultant?
• 7:38
  Punit Bhatia: I think you do what you do best and you do it publicly. That's Mhmm. That's what it is. So for example, when I was setting it up in 02/1718, you would remember that I came in touch with your courses, and you were creating the GDPR course which I created for you. And at that time Yep.
• 7:56
  Due to my employment restrictions, I couldn't do the videos.
• 8:00
  Dejan Kosutic: Yeah.
• 8:00
  Punit Bhatia: And so that gives you visibility because people will see I have written a course, and they approach me. You like, you I'm also doing a podcast for last five years. It was now six years. I don't time flies. And that also happened coincidentally.
• 8:17
  Somebody said, you should do content marketing. Now what is content marketing? You talk about content. If I keep talking about content, then I have what can I talk? I mean, after a few episodes, it goes through.
• 8:32
  So then I said, okay. Let's invite people and talk to them. That way, I learn, they learn, and people get to hear me and themselves. So that's another thing. So you do content marketing.
• 8:42
  You create some videos and publish them.
• 8:44
  Dejan Kosutic: Yeah. Mhmm.
• 8:46
  Punit Bhatia: And then, basically, the idea is you do all actions which make you visible, like speaking at conferences, creating a podcast, creating some videos, writing some posts on LinkedIn. Now the lesson there has been that you focus on the right thing because sometimes people are like, no. You should post on LinkedIn every week, twice a week, twice a week. There are people said telling you that because social media gurus. But then that doesn't work.
• 9:14
  You have to be relevant, and you have to be right. So if I have a post and if I want to say something, I'll say it four times in a week. But if I don't have something for four months, I'm comfortable in my skin not saying it also. But create one or two things which are regular, like my podcast is regular happening every two weeks. Mhmm.
• 9:33
  Then rest can be instance based because you have to be consistently visible to people and letting them know, then create a network like speak at events. And if you speak at events, like, between 02/2005 and now 02/2025, I would have spoken at more than 75 or 80 events. Wow. Wow. Means and there also, initially, you have to go out and say, I want to speak.
• 9:57
  Then eventually, when you're established, people come in and say you want to speak. And then, of course, there's always a temptation that you make it your business, but that gets your business, that's not your business.
• 10:09
  Dejan Kosutic: But how do you actually achieve to get to speak at the conferences? Okay, one thing is to contact the conference organizers, but how do you make it? How do you actually make it in?
• 10:24
  Punit Bhatia: I can tell you what I do, but I'm still a learner. So what I do is I look out for key conferences and I see their call for speakers, and I make an application. And if they accept, that's okay. That's the one thing I do for big conferences. For others, people know that I want to, and I like to speak, and I'm good.
• 10:44
  So they approach me saying, there's this topic. Would you like to talk? And usually, if there's good audience, it matches with my interest, and it's at it's not going to cost a lot. I would say yes. And sometimes people will contact you out of the way saying, we will pay you for travel.
• 11:01
  We'll pay you for accommodation, and would you like to speak? And then that's the best case.
• 11:08
  Dejan Kosutic: Okay, but how do the people know that you are actually available and how would they actually trust that you are a good speaker in the first place? How do you actually get to that point where you are such a, let's say, wanted speaker?
• 11:24
  Punit Bhatia: That's a very good question. I never thought like that, but when I started, I was in the bank still. And Mhmm. When I was going at a conference, I would say, I want to speak. Mhmm.
• 11:37
  And then there was this gravitas because of the bank. And they said, yes. We want to hear what they are doing. And I separated what's in the bank and what I want to say. And I told them Mhmm.
• 11:48
  With a disclaimer that it's not the bank, it's me. And that gave me the initial opportunities. And when I knew I'm good, I like to I enjoy it and everything, people also started to know. And then I made a few videos. So based on those videos, they have an evidence that I'm a good speaker and I can speak.
• 12:06
  Uh-huh. And then when conferences are happening over time, people start calling you.
• 12:11
  Dejan Kosutic: Okay. And these videos, you publish them on YouTube or or or your website? Or where are these videos? Everywhere.
• 12:21
  Punit Bhatia: Wherever you can. So I'll explain you what does everywhere mean. First, you create a video and publish it on YouTube. Mhmm. Then you make that visible on LinkedIn or Facebook.
• 12:33
  I tried Facebook, but Facebook is not where where where my audience is. Yeah. So then LinkedIn, you inform people. And then yeah. So wherever it's feasible.
• 12:44
  And sometimes when somebody's saying, we want to work with you, but we don't know who you are, what kind of say, hey. Watch this video. You'll get an essence of what kind of a person I am. So, basically, LinkedIn and YouTube, and if needed, some other channels.
• 13:01
  Dejan Kosutic: Okay. And when you think about which channels are are the most effective, is there anything else beyond YouTube and and LinkedIn, or are these the primary two channels for for for you?
• 13:15
  Punit Bhatia: Every business is different, and I think every channel is relevant for a type of business. So I tried Facebook, Instagram, LinkedIn, Twitter, even Google Ads, and this YouTube. And later on, after struggling and trying and testing, and I found I'm better off in LinkedIn and YouTube. So that's what I use primarily. Sometimes I go on Instagram, so that's where I have, but I still have my pages on Facebook.
• 13:44
  Dejan Kosutic: Yeah. Yeah. I mean, it's it's also my experience. What works best for me, it's also LinkedIn and YouTube. I'm trying a little bit of TikTok, but it's not as effective as YouTube.
• 13:56
  I assume that LinkedIn and YouTube, you're not using them for the same purpose, let's say. What kind of posts are you going for on LinkedIn and what kind of materials or videos are you going on YouTube? So how do you actually differentiate or or decide what goes where?
• 14:16
  Punit Bhatia: So YouTube is primarily for my podcast. And once in a while, when I know a lot of people are asking opinion on this and I don't want to share that every time to a client and it can be a starting conversation, then I put a YouTube video. Uh-huh. So it's primarily two things. Then podcast in conversations with people, and second being my own view on a topic, like, say, the EU AI act ISO 42,001 EU GDPR.
• 14:46
  And then LinkedIn is more about sharing my observations, opinions, thoughts, and reactions to certain events or situations. And there, you got to be original. When I say original, some people say you go to social media advisers or coaches. They'll say you should do these seven types of posts. You should do these many times.
• 15:09
  Well, yes. But privacy or AI are not funny topics, so you can't have a whole other thing. And then same way, privacy when I'm preaching privacy and AI, I can't be there, say there, hey. I'm on a holiday. Please see me.
• 15:25
  So you have to see what works for you, and that no coach would tell you. No guide will tell you. So that you apply judgment. Then some people will say, privacy is so nice. AI is so nice.
• 15:35
  Tell them there will be 35,000,000 of fine or 7% of fine for EUAI Act. No.
• 15:41
  Dejan Kosutic: Mhmm.
• 15:41
  Punit Bhatia: I don't want to be known for the guy who helps them with fines or protect fines. I want to be the guy who helps them create trust because that's what AI and privacy are all about. So you identify who you are and then you put yourself in the market or in front of people, this is who I am, this is what I do.
• 16:01
  Dejan Kosutic: How do you actually decide what kind of posts are you posting on LinkedIn? Because you previously said that you're posting only if there is really something interesting that you have to say. How do you really decide interesting and what actually builds trust for you as an expert?
• 16:20
  Punit Bhatia: I've been blessed with a sense of the moment, let's say. So what I do is if I'm speaking at an event, I would talk about that. Or if I have spoken at an event, I'll not say I have spoken at. It was a nice event, and I don't do that. Blah blah.
• 16:37
  I say I was there. These are the things I learned. This is what I learned from and this was my topic. This was others topic. That way it's useful for people.
• 16:46
  Because if I say, hey. I was at this conference in North America. There were thousand people. It was wonderful to see people. Mhmm.
• 16:54
  Then it's bragging in my mind. Yeah. But if I say, I I was in this conference in North America. There was good crowd, and I had these colleagues along with me as fellow speakers, and I learned these seven things. But first, I talk about the seven things, then I talk about being at a conference, and that's more relevant because people would like to read the post.
• 17:15
  Otherwise, it's just click like and move on.
• 17:18
  Dejan Kosutic: Yeah. Yeah. I mean, also from my experience, you know, I I very often talk to our clients and and very often I I listen to, let's the challenges that they have with compliance. Usually these are the things that I'm trying to post, the solutions to these kind of problems. Very much like what you're doing, okay, I'm not speaking at conferences, but I'm more in in contact with with these customers.
• 17:44
  It's also very similar approach. I'm trying to find out what is really interesting for these people and then try to post and and this is these are usually the the most most interesting posts. Yeah.
• 17:56
  Punit Bhatia: Yeah. And I think there's no magic. If you do things that are relevant for people, if you do things that genuinely you believe in, not just because somebody said you are on social media, and if you genuinely are consistently doing things for a regularly long time like, when I started my podcast in 02/2019, I didn't know how to do a podcast. Somebody said record a few interviews. I did so.
• 18:22
  Then that guy said, just keep them, but it's not my consciousness. Didn't allow it. And then I had a gentleman who was in a senior position, and he said, Puneet, when are we releasing it? So I was forced to find out how to edit and publish a podcast. And then I did it for now six, seven years.
• 18:40
  And so do it consistently and what works for you genuinely. Don't do it if people are saying it or some book is saying it. If you believe in it, do it.
• 18:51
  Dejan Kosutic: Mhmm. So you're saying that you started the podcast as a kind of natural thing to do. Is this what you're saying?
• 18:59
  Punit Bhatia: I mean, when at that time, I was with a business coach, and he was saying you should create collateral which you can share with clients as an evidence to say you know it, and then you can bring opinions and everything. So that's why we recorded a few episodes. So he said record seven. Then I said, what do I do with this? He said, don't worry.
• 19:20
  We will create a library. When your clients come, they can access it. But that was not what who I wanted to be, and then, of course, this gentleman. So then we published it. And in a few episodes, I realized it's about conversation and it's about bringing insights about AI privacy trust topics to people and learning from each other because these are complex topics and everybody has an opinion.
• 19:45
  Dejan Kosutic: Yeah. No, that's great. It's great. Mean, by the way, you've made more than 130 episodes, right? Yeah.
• 19:52
  It's really impressive. Congratulations. Thank you so much. Great. So how do we mean, let's speak a little bit about more about your podcast.
• 20:01
  How do you actually determine who do you want to speak to?
• 20:06
  Punit Bhatia: That's also a very good question. I simply go on LinkedIn and search for people of a specific topic, like say, digital trust, those who have in the title or AI or privacy or compliance or risk in their list. And I tried to watch out if they would be a fit into my philosophy and they would be relevant for audience.
• 20:34
  Dejan Kosutic: Okay.
• 20:34
  Punit Bhatia: And then I approached them saying, hey. I've been looking at your profile. I think you'll be a good fit. I'm running this podcast. Would you like to join?
• 20:44
  So that's the first thing. And but initially, it's difficult. So initially, I went around this closed circle, and I asked them, would you recommend to people who would like to be on this podcast? And then from one to two and every time episodes were created. And then when you've done that for enough time, like in last one year, a lot of people approached me saying, we want to be on your podcast.
• 21:06
  Uh-huh. So that makes life easier.
• 21:09
  Dejan Kosutic: Yeah. In the beginning it's much harder, but once you get known, actually once you do, well, a hundred or more podcasts, becomes easier. How
• 21:21
  Punit Bhatia: do
• 21:22
  Dejan Kosutic: you then prepare for a podcast? Let's say that someone says, Yes, okay, I want to do an interview with you. How do you actually make an interesting podcast? What do you have to do to prepare for such a podcast? Professional podcast, of course.
• 21:39
  Punit Bhatia: There are few things you have to do when you're connecting or finding the people person. Mhmm. At that moment, you need to have in your head clear what does this person bring to you or your audience. Mhmm. So let's say, if I would have you, I would say ISO standards.
• 21:57
  Dejan Kosutic: Okay. Okay.
• 21:57
  Punit Bhatia: Then I would craft some questions, four or five, about that topic in alignment with my topic. And I'll say, hey, Dejan. Would you like to speak about these five topics? And if you have any other questions in your mind, please feel free to add them. And then when we are in the conversation, it's about using it as a conversation flow rather than a set set of ideas.
• 22:20
  Like, earlier in the day, was recording with somebody, and the question sequence demanded the conversation sequence demanded something, but the flow of conversation demanded something. So then I let the con sequence go, and the flow continue. And then when you're in the interview, be present, talk to people, listen to what they're saying, learn from them, and then try to find what would be the next right question. Mhmm. Yeah.
• 22:48
  Dejan Kosutic: Okay. Yeah. So I mean, it's obviously a technique that everyone who wants to be a podcaster needs to learn, but it seems to me that if you know something about topic, if you're interviewing someone, I don't know, about cybersecurity, if you do something no about cybersecurity, then this conversation tends to to flow more easily. And, of course, if you know the the background of this person, it also helps, I would say, to to kind of drive the the the conversation into a certain direction. Okay.
• 23:21
  And how do you use all of these materials like the LinkedIn and podcast? How do you actually use them for your business? I mean, what is their how do you make this connection between, you know, posting all of these materials and actually getting new clients?
• 23:38
  Punit Bhatia: That's a very good question. A lot of people ask me, but it's very hard to correlate all these things because some people are coming from a MBA mindset saying, if I do x number of videos, spend x amount of euros, then there should be y amount of return. Mhmm. I don't know if it happens. I hope it happens for some people.
• 23:59
  But I look at it more as an investment strategy. So investment strategy is you're doing what you love. You're recording or talking to people whom you want to talk to. You're learning from them and growing in that. So there's a benefit for you, and you're putting it out in the market.
• 24:18
  And all combined, you're getting some presence and leverage. And with that presence and leverage, if people are coming to you, that's good. If they're not, that's also okay. And if not I mean, when okay meaning, then you find out what is it to be changed, and then you adapt. Yeah.
• 24:36
  Like when I initially started, I was thinking I would sell courses. Okay? Interesting thought. You can sell courses. People make a very good business like you are making a very good business, but I didn't have clarity on that.
• 24:48
  And then I said, I want to be a consultant, but then I wanted to do part time consulting. And then eventually, I evolved into my primary clients, and secondary clients, and tertiary client formula. And then that's how you so you keep evolving. So you keep thinking what works, what doesn't work. I tried these courses and webinars things for about one year.
• 25:10
  About 10 people would show up for a webinar, some time 30. Nobody would buy. You give them the call to action and the hook and everything that social media guys tell you. But it it's not so easy, and it's not a numbers game that you've done 10 episodes and so many will come. It's about a it's a holistic approach, as I said, three sixty degree approach.
• 25:32
  You do these things, and you don't lose hope.
• 25:37
  Dejan Kosutic: Keep doing things. But you're but you're building your own brand. Right? It's basically about brand building.
• 25:42
  Punit Bhatia: Yeah. It's also about brand building, and it's also about consistency.
• 25:46
  Dejan Kosutic: Mhmm. Yep. Okay. So besides the the YouTube and LinkedIn and and conferences, you also written a couple of books. Right?
• 25:58
  And how are these books important for this brand building of of of your, let's say, name, your consultancy?
• 26:07
  Punit Bhatia: So these were the initial instruments because if I go to a conference or if I want to talk about in a podcast, nobody knows it. So then Mhmm. Initially, you have some knowledge and you convert that knowledge into an asset and that's a book. Okay. And then you don't write a book because you want to write a book for people.
• 26:26
  You write a book and make it as much complete as possible. So think of a giving consultancy to a client. So you write that. And then you make it available. Let people absorb it, and then that gives you a reason to say I'm writing a book.
• 26:40
  I'm publishing a book. So you can have some ten, twenty posts. And then when people have read it and the book is well received and everything, then they know you. So you don't need to continue to write books, of course, unless you are a philosopher and the market is so wide that you're going to sell million copies every time. That's a different story.
• 26:58
  But in our world of security, privacy, and AI, you won't sell million copies. If you sell thousand copies of 2,000, three thousand copies, that's a good amount of number.
• 27:09
  Dejan Kosutic: Yeah.
• 27:10
  Punit Bhatia: So that's a tool to say I know and I've done it. And that gives you access to the conferences sometimes. Uh-huh. And that gives you access to the podcast and access to say, to clients I've written a book. And all that combined then becomes part of the story.
• 27:26
  So books is the step one, and then conference is the step two, and podcast if you want to do step three. Posts anyways. But you can't post if you don't have a reason. That's where the podcast helps me.
• 27:38
  Dejan Kosutic: Uh-huh. Great. It's very interesting how you're kind of making this in in kind of first steps and and really starting with with a book and then everything else. So it does make sense. And by the way, I started very similarly.
• 27:50
  I also published a couple of books in the beginning and then started building most of these other things. Even though I must say that ten years ago, big books were much more important than it seems to me than now. Now this video format, it seems to me it's becoming dominant and would say mainstream, whereas books, they are still important but not as much maybe ten or twenty years ago. So at least for my my experience.
• 28:17
  Punit Bhatia: I would have a different opinion. I think there in the market, are people who read and listen to books. There are people who consume videos, there are people who consume audio. Uh-huh. So you need to cater to all of them, and you can't say this is not going to be my client.
• 28:36
  So you need to be there everywhere, but in a reasonable way. So and you need to optimize your effort. So for initially, wrote books, but I didn't convert them into audiobooks. Now the podcast is audio and video, so both angles are just covered. So there's it it's like banks.
• 28:56
  They said ATMs would go away in a '19 or 1990 or February, they started to say that. Now in 02/2025, there are less ATMs for sure. There's more use of plastic. But still, there are people who carry cash. Maybe in 02/1950, we will have even less ATMs, but it won't be that ATMs won't exist in 02/1950.
• 29:16
  Yeah. Yeah. So there's a shift. Yes. I agree with you.
• 29:20
  But irrelevant, I have a different opinion.
• 29:24
  Dejan Kosutic: Okay. Mean, lots of approaches as you were saying. By the way, speaking of, let's say, podcast, do you do only podcasts on YouTube or are are you also having an audio version of podcasts on some other platforms?
• 29:41
  Punit Bhatia: So I publish on all platforms, an audio version and a YouTube version because not everybody is on YouTube and not everybody is on a podcast platform. And even on a podcast platform, some use Spotify, some use Apple, some use Amazon, and you name it. I don't know how many platforms are there. So I Mhmm. Upload my platform at podcast audio at one level, and that distributes to all the platforms.
• 30:06
  Dejan Kosutic: Okay, great. Now some consultants actually feel uncomfortable becoming, let's say, such a semi public person where shoot all these videos, speak at conferences and so on. So what is your take on this? Is it hard actually to make yourself known and show yourself?
• 30:28
  Punit Bhatia: I would say the question is, do you need to or do you want to? If you have a very good network and you're getting consistent clients and you're comfortable with that and you have enough business more business than what you can handle, so you don't need to. But if you're in my situation that the primary market in Belgium and Netherlands is Dutch and French and which I don't speak that well, and then you have to go out and position yourself, then you do need to. So it's a situational question. Then also if your aspiration is primary clients only, so day job is good enough and rest I can handle.
• 31:06
  I don't want it. That's also okay. It's about aspirations, it's about needs, and it's about situation. In my case, I wanted to attract The US clients and UK clients, let's say predominantly English speaking clients, and that's where I thought the need to go out there and express myself.
• 31:27
  Dejan Kosutic: Yeah, and I mean, the opposite is also kind of true because if you didn't do this, you wouldn't have all of these clients. So it seems to me that if you want to get a clientele, this is simply a part of the job and this is how everyone in this business should be seeing this, as simply one of the things that you have to do to find clients.
• 31:49
  Punit Bhatia: Yeah. But you said very important points. Is it difficult? No. It is difficult when you are not convinced.
• 31:59
  If you are convinced, then it's easy. So I've seen some people saying, I I have to record a video. They will procrastinate for two weeks, and then they will reluctantly write a script, then they will reluctantly record, and then it doesn't show up. And then they do five videos and say, it's not working. Yes.
• 32:19
  It doesn't work in five videos. I mean, in podcast, even after fifth about thirty, twenty five episodes, I was about to say, should I do it? But then somebody published a ranking and I was in the top five. I said, okay, let's do one more year. Then another one says it's in the top five.
• 32:38
  Then another one says I'm number one. Now it's an opinion. Let's not get too fascinated by it. It's an opinion of somebody saying you are number one or five or you're not even good. But then you continue and continue.
• 32:51
  And now after five years, I'm like, okay, let's see if we can do thousand episodes. We'll see.
• 32:58
  Dejan Kosutic: That's a nice goal, getting to a number of thousand. And you are absolutely right, as we discussed before, editing technical part of this whole video business is rather easy. There are these tools that enable you to do it, but much harder is really to figure out what you want to say and much harder is actually to put this content out. If you know the stuff, if you know about a particular card really to create a script, especially if you have ChatGPT which can help you form it into something that is, let's say, legible. I think it comes down to exactly what you're saying.
• 33:45
  If you have this determination that you want to do it and you must do it to succeed, then it becomes easier.
• 33:54
  Punit Bhatia: Yeah, it does. It does. Even it happens to me. Sometimes I don't publish a video for one or two years, but that means I've been busy with my clients, I've been doing okay. And then when there are lesser clients and then say, maybe let's publish a video on this because you're searching, seeking, looking for clients, and that's the moment then you go more out in the market.
• 34:17
  So there can be phases, but something in the background has to continue consistently because it cannot be you publish a few videos, then you get clients, and then for one year you're away, and then you come back. So there has to be a bit of balance. It's not like when I say I publish when I need to, but when I have something, you also keep some rhythm that at least once in one, two months, I say something. Like this time I haven't said it for two, three months, so I'm eager to say why is the idea not coming.
• 34:51
  Dejan Kosutic: Okay. Now, can you speak a little bit about your expertise? So I know that, let's say, a couple of years ago you were primarily focused on privacy, so GDPR, these kind of things, but now I noticed that you're switching towards AI. So how come that you didn't stay in privacy only? Why did you actually go towards AI as well?
• 35:15
  Punit Bhatia: So what I observed is when we were talking about privacy and helping companies in the field of privacy, that is building the strategy, policy and implementation, Privacy has to do a lot with data.
• 35:27
  Dejan Kosutic: Okay.
• 35:28
  Punit Bhatia: So if you talk about data governance and data management, then privacy governance becomes easier. So that's why I help some clients with privacy AI data. And when it comes to data or even privacy, AI is interlinked. Now Mhmm. Can you do AI without privacy or privacy without AI?
• 35:46
  That's debatable. Everyone will give you a different opinion, but it's linked. If you run AI governance, there is privacy governance. And if you do data governance, it's more or less related. And in a medium sized company, you don't want to do three of them.
• 36:01
  You want to do one of them Mhmm. Or one of them combined. So that's where I started with AI because some of my clients needed that help. They were we were doing privacy governance. I was aware of AI.
• 36:14
  I was trained on AI, and I said, Let's do it. But I don't do the technical stuff of AI. I do the private AI governance, AI setup, AI foundations, and AI compliance.
• 36:26
  Dejan Kosutic: Okay. Okay. And, yeah, I mean, if I may add, I would also add that if you speak about this data governance, the cybersecurity is also kind of close here. So I would say it's it's privacy, AI and cyber security is a kind of three things that revolve around data governance. That's true.
• 36:45
  Now, I wanted to ask you around AI, so there is this standard ISO 42,001, which is basically the international standard for AI. On the other hand, there is also this ISO 27,701 for privacy management, but it didn't really take off. I mean, it's not nearly as close as popular, let's say, as 27,001, even though I think that 27,701 is pretty good standard, but it's not as popular as 27,001. So what do you think will happen with 42,001? Is this Is there a future for this standard?
• 37:25
  And if you ask, how do you think it will be compared to, let's say, 27,001?
• 37:30
  Punit Bhatia: I think you're asking two questions broadly. Why didn't the ISO 27,001 go forward or get acceptability as much as ISO 27,001 and the future on my view on 42,001. So let me first handle the 27,701. The way it worked is ISO 27,001 was the information security management systems.
• 37:53
  Dejan Kosutic: Mhmm.
• 37:53
  Punit Bhatia: And that allowed people to set it up. Now some of those information management systems, as a subset, are privacy information management systems. And that's where they added a bolt on riding the wave of GDPR and said ISO 27,701. Now typically companies would not ask you if you're compliant with ISO 27,701. They will ask how you're with GDPR or any other specific law.
• 38:20
  So that was the reason the ISO 27,701 didn't take up as much. But then some companies are saying we are compliant with or we are aligned with this ISO 27,007, But it didn't as much as 27,001. So you're right. But the reason was GDPR compliance took priority. Now when it comes to ISO 42,001, that's a base standard.
• 38:44
  This is not like 42,201. Not like that. So it's about AI. And when we talk about AI, everybody is talking responsible AI, accountable AI, ethical AI, or any kind of AI. Now how do you develop this responsible or ethical EU has put up its own framework called EU AI Act and then there's the ISO 42,001 which have close similarities.
• 39:11
  So there I think companies would use ISO 42,001 as a means to achieve the AI governance or alignment with EU AI act. That's how I see. So it will be more acceptable and more adopted than ISO 27,701. But of course, time will tell. But my opinion is it's relevant and it will come up.
• 39:34
  Dejan Kosutic: Yeah. Yeah. No. It's also my opinion. I I think 42,001 will be very, very interesting.
• 39:40
  And my company is also very, very seriously considering starting doing some materials for the standard. I think also this is going to be a very, very interesting standard as well. Okay, so just kind of trying to go to wrap up the interview. What would you say are kind of the most important things that you could recommend to consultants when it comes to building this personal brand and using this content actually to, let's say, get yourself known and to find clients. So what are the most important things?
• 40:19
  Punit Bhatia: I think know your niche, what you're wanting to do and what you're enjoying doing. Know your customer or segment, and then find out a plan, whether it's social media driven or in person driven or network driven or conference driven or podcast driven on how do you show up. How do you tell them, I'm here and I do this? That's in essence. Mhmm.
• 40:44
  Dejan Kosutic: Okay. Great. So great. It was great speaking to you. So let's let's end up with this great words.
• 40:52
  So thank you for insights, Punit and it was it's been a pleasure talking to you today.
• 40:58
  Punit Bhatia: Thank you so much, Dejan. It was pleasure sharing my thoughts and being here.
• 41:03
  Dejan Kosutic: So thank you. Thank you, everyone, for listening or watching this podcast. So so see you again in two weeks time in our new episode of of Secure and Simple podcast. Thanks for making it this far in today's episode of Secure and Simple podcast. Here's some useful info for consultants and other professionals who do cybersecurity governance and compliance for a living.
• 41:26
  On Advisera website, you can check out various tools that can help your business. For example, Conformio software enables you to streamline and scale ISO 27,001 implementation and maintenance for your clients. The white label documentation toolkits for NIS2, DORA, ISO 27,001 and other ISO standards enable you to create all the required documents for your clients. Accredited Lead auditor and Lead implementer courses for various standards and frameworks enable you to show your expertise to potential clients. And a learning management system called Company Training Academy with numerous videos for NIS2, DORA, ISO 27,001 and other frameworks enable you to organize training and awareness programs for your clients' workforce.
• 42:14
  Check out the links in the description below for more information. If you like this podcast, please give it a thumbs up, it helps us with better ranking and I would also appreciate if you share it with your colleagues. That's it for today, stay safe!