Notifications
Clear all
Topic starter
19/08/2026 3:26 pm
TL;DR: Global privacy enforcement is converging on AI data use, broker deletion rights, complaint handling, and breach reporting, according to Ground Labs, while Australia’s 2025 notifications hit 1,205 and South Korea fined three organisations for inadequate safeguards. For identity teams, the issue is no longer just compliance paperwork but controlling what personal data enters models, brokers, and verification workflows.
NHIMG editorial — based on content published by Ground Labs: Privacy news roundup | July 2026
By the numbers:
- Australia's OAIC received 1,205 breach notifications in 2025, an 8% increase over 2024.
Questions worth separating out
Q: How should organisations govern access to data used by AI systems?
A: Treat AI data access as an identity governance problem, not just a data storage problem.
Q: Why do data deletion requests fail in practice?
A: They fail when organisations can delete one record but not the copies, derivatives, partner feeds, or repopulated data that continue to exist elsewhere.
Q: How do you know a privacy complaint process is actually working?
A: You know it is working when complaints are acknowledged within the required time, routed to the correct owner, and resolved with evidence that the underlying data issue was addressed.
Practitioner guidance
- Move privacy review before AI ingestion Require pre-ingestion review for scraped, brokered, or contributed datasets, with explicit checks for personal and sensitive data before model training or retrieval starts.
- Test deletion across copies and derivatives Validate that deletion requests remove matching records, backups, derived datasets, and reimport paths across every connected system, not just the first repository that receives the request.
- Link complaint handling to data ownership Assign a named owner for every complaint path so acknowledgement, investigation, and remediation can be traced to a specific privacy or identity control owner.
What's in the full article
Ground Labs' full blog post covers the operational detail this post intentionally leaves for the source:
- Country-by-country privacy law updates and how each one changes compliance workflows for AI and data teams
- Specific obligations for web scraping, deletion requests, complaint handling, and personal data in generative AI
- Regulatory context behind Australia, the UK, Singapore, South Korea, California, and New Jersey
- The article's practical emphasis on where privacy controls should sit in the data lifecycle rather than in legal review alone
Privacy regulation and AI data use are tightening. What changes now?
Explore further
19/08/2026 4:10 pm
Data minimisation now functions as a control, not a policy statement: the article shows regulators pushing responsibility upstream into collection, filtering, and model ingestion decisions. If an organisation cannot prevent sensitive data from entering a pipeline, downstream privacy controls are already too late. That makes pre-ingestion screening and purpose control the real governance boundary for AI and data teams.
A question worth separating out:
Q: Should identity verification teams retain full identity documents after checks are complete?
A: Usually no. Verification teams should retain only what they need for lawful recordkeeping and ongoing risk management, because full documents expand exposure without improving control after the check is complete. Retention should be minimised, access should be restricted, and deletion or truncation should be governed by clear legal and operational requirements.
👉 Read our full editorial: Privacy regulation tightens as AI data use and breach rates rise
