They should align on data inventories, notification triggers, retention rules, and the controls that prove who accessed personal information and when. The law is not satisfied by a policy alone, because operational evidence comes from access logs, workflow records, and incident registers that both teams can trust.
How privacy and security teams should divide the work
Law 25 compliance is strongest when privacy and security treat the same control set as shared evidence, not separate programmes. Privacy owns the legal interpretation of what data is collected, why it is held, and when notices or consent-related duties are triggered; security owns the technical and operational proof that those rules are enforced, recorded, and reviewable.
The practical line is simple: privacy defines the policy intent, but security must make that intent observable in systems. That means aligned definitions for personal information inventories, retention schedules, access review cadence, log retention, and the point at which an incident becomes a reportable privacy event.
Because Law 25 compliance depends on being able to demonstrate behaviour, both teams should agree on the same record of truth for privacy-by-design and security-of-processing expectations, even though the legal regime is not identical. If the inventory, logging model, and exception process differ by team, audits usually expose gaps in ownership before they expose technical weakness.
What evidence both teams need to trust
The key alignment point is evidence quality. A policy that says access is limited or data is deleted on schedule is not enough unless the organisation can produce access logs, workflow records, deletion or retention events, and incident registers that line up with the policy date and scope.
Privacy teams should be able to trace where personal information lives, which business purpose justifies it, and how long each category is retained. Security teams should be able to show who accessed that data, from which system or workflow, under what approval, and whether the access was legitimate, reviewed, and time-bounded.
This is also where a privacy risk management model helps translate legal duties into operating controls. In practice, the best implementations make inventory changes, access approvals, and deletion actions auditable enough that either team can answer an inquiry without reconstructing the history from emails or tickets.
The most useful question for both teams is not “do we have a policy?” but “can we prove the policy was followed for this dataset, this period, and this incident?” That is the difference between documented intention and defensible compliance.
Where Law 25 programs usually fail in practice
Law 25 programs tend to break down when privacy and security use different scopes for the same data set. One team may classify a record as personal information, while the other treats the corresponding system log, export file, or support workflow as outside the compliance boundary.
Another common failure is weak linkage between retention and access control. If records are kept longer than necessary, or access is not removed when a role changes, the organisation may still have a written rule but lose the operational evidence that the rule was enforced. Audit and access-control controls are especially relevant here because they connect privacy obligations to technical proof, not just governance language.
Incident handling is another fault line. Privacy may need notice and documentation for personal information incidents, while security may focus first on containment and forensic scope. If those paths are not pre-aligned, the organisation can miss notification thresholds or fail to preserve the records needed to justify its decision.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art. 25 — Data protection by design and by default | Law 25 compliance needs privacy-by-design style operational alignment on data handling and evidence. |
| Recommendation — Embed privacy requirements into inventories, retention, and logging from the start. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Access and incident evidence depend on auditable records for personal information handling. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Teams must review logs and workflow records to validate privacy controls are operating. | |
| AC-6 — Least Privilege | Law 25 compliance depends on restricting who can access personal information. | |
| Recommendation — Define audit events that prove access, retention, and incident actions. Review audit records for access, deletion, and notification exceptions. Limit access to personal information to approved business need. | ||
Practitioner Guidance
What to prioritise: Build one shared inventory that ties each personal-information category to a business purpose, retention rule, access path, and incident owner. If any of those links are missing, compliance will be difficult to prove even when the control exists.
What to verify: Confirm that access logs, workflow records, and incident registers use the same identifiers and retention periods as the privacy inventory. If they cannot be joined cleanly during an audit or incident review, the operating model is too fragmented.
Decision rule: If a control cannot produce dated, attributable evidence for access, retention, or notification decisions, treat it as incomplete and not yet ready for reliance.
Practitioner takeaway: For Law 25, the real alignment target is not shared language, it is shared proof, because privacy obligations are only credible when security can evidence how the organisation handled personal information over time.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org