Notifications
Clear all
Topic starter
19/08/2026 3:30 pm
TL;DR: Privacy regulators are shifting from policy review to proof of how personal data is collected, used, shared and deleted, according to Ground Labs, with developments spanning GDPR transparency checks, California deletion obligations, Brazil enforcement changes and new notification rules in New Zealand. The governance gap is now operational visibility into data flows, not the absence of privacy statements.
NHIMG editorial — based on content published by Ground Labs: Privacy news roundup | April 2026
By the numbers:
- Around 75% of organisations in India said budgets would be diverted from digital growth initiatives to compliance-related tools and services.
Questions worth separating out
Q: How should organisations operationalise privacy compliance when laws and codes overlap?
A: Start with a single data inventory and map each processing step to the law, code, or jurisdiction that governs it.
Q: Why do privacy laws increasingly affect IAM and access governance?
A: Privacy laws increasingly affect IAM because many obligations depend on proving who accessed personal data, when they accessed it, and whether that access matched purpose and retention rules.
Q: What breaks when organisations cannot find all copies of personal data?
A: Erasure, retention, transfer governance, and breach scoping all break when personal data is not fully discoverable.
Practitioner guidance
- Build a personal-data inventory tied to systems and identities Record where personal data is stored, which identities and applications can access it, and what purpose each dataset serves.
- Create deletion workflows with proof of execution Define how deletion requests are received, routed, validated and confirmed, then retain evidence that downstream systems actually removed or suppressed the data.
- Review automated decision inputs and safeguards For recruitment or similar high-impact workflows, document the source of the input data, the approved basis for use, and the controls that prevent bias, inaccurate inference or unauthorised reuse.
What's in the full article
Ground Labs' full blog post covers the operational detail this post intentionally leaves for the source:
- The jurisdiction-by-jurisdiction privacy updates that explain how each regulator is tightening expectations
- The specific guidance points on automated decision-making in recruitment and what compliant use requires
- The operational changes behind California's deletion cadence, Brazil's enforcement shift and New Zealand's indirect-collection rules
- The privacy compliance implications for organisations that need to update notices, contracts and internal workflows
Privacy enforcement is becoming a data-mapping problem, not a policy one?
Explore further
19/08/2026 4:13 pm
Privacy enforcement is now a control-verification exercise, not a policy-review exercise. The roundup shows regulators asking organisations to demonstrate what happens to personal data after collection, not merely to publish notices. That raises the bar for evidence across access, retention, deletion and purpose limitation. For practitioners, privacy readiness now depends on whether controls can be audited end to end.
A question worth separating out:
Q: Which teams should own privacy evidence when automated decisions use personal data?
A: Privacy, IAM, data governance, legal and the business owner of the workflow should share ownership. The critical requirement is documented accountability for the data inputs, the access model and the safeguards around the decision process, not just the model output.
👉 Read our full editorial: Privacy enforcement is becoming a data-mapping problem, not a policy one
