Topic starter
10/07/2026 9:23 pm
TL;DR: California’s evolving privacy framework is expanding who can qualify as a data broker, shifting the burden from business model labels to how personal data is collected, shared, and operationally handled across systems, according to OneTrust. The practical risk is not classification alone but whether teams can execute recurring rights requests, downstream deletion, and audit-ready proof at scale.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Why More Organizations Now Qualify As Data Brokers”.
By the numbers:
- Starting August 1, 2026, data brokers must access DROP at least once every 45 days.
Key questions
Q: What breaks when a privacy programme has no direct consumer relationship to anchor DSAR handling?
A: Teams lose the contextual signals that normally help them locate, match, and route rights requests.
Q: Why do recurring data broker obligations create higher compliance risk than one-off DSARs?
A: Recurrence turns privacy into a repeatable operating model.
Q: How do privacy teams know whether downstream sharing is creating hidden obligations?
A: They should look for data that leaves the first-party boundary and is reused, enriched, or activated by another party without a direct consumer relationship.
Practitioner guidance
- Reassess broker scope using actual data flows Review whether the organisation receives, enriches, activates, or shares personal data without a direct consumer relationship, then document where that creates California broker exposure.
- Map downstream deletion obligations end to end Trace each disclosure to third parties, analytics providers, and activation platforms so deletion and access requests can follow the data beyond internal systems.
- Define ownership for recurring request fulfilment Assign named owners for matching, deletion, evidence capture, and escalation so recurring DROP cycles do not depend on ad hoc inbox handling.
Bottom line: California’s expanding data broker scope turns indirect collection and downstream sharing into operational compliance risks, not just legal classification questions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:46 pm
Data broker scope is becoming a data governance problem, not just a legal classification problem. The article shows that California’s framework now turns on how data moves and is used, which means operational controls matter as much as policy wording. Organisations that rely on indirect collection, enrichment, or downstream activation need a defensible view of the entire data path. Practitioners should treat scope assessment as an ongoing governance discipline, not a one-time legal review.
A few things that frame the scale:
- Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
A question worth separating out:
Q: Should organisations centralise DSAR fulfilment or keep it inside business teams?
A: Centralisation usually works better when requests span multiple systems and third parties, because consistency and evidence matter more than local speed. Business teams still need ownership of the underlying data, but a coordinated fulfilment layer reduces missed steps, duplicated work, and incomplete deletion proof. The right model is shared execution with single-point accountability.
👉 Read our full editorial: California's expanding data broker scope raises privacy operations risk