Data protection law makes the organisation prove, on demand, that it knows what personal data it holds, why it holds it and who and what can reach it, and most boards cannot see whether that proof exists. Regulators in Europe and the UK now fine for weak security as readily as for unlawful processing, and US states are adding written risk assessments and independent cybersecurity audits to their privacy laws. AI systems and agents add a new layer: they process personal data at scale, often through credentials nobody reviews. This briefing is for directors, chief executives, general counsel, data protection officers, chief risk officers and CISOs. It explains the exposure in business terms, the questions to ask and the evidence to expect. Programme detail sits in the Privacy Programme Guide for Security Teams, and the legal detail in the jurisdiction guides linked below.
The risk in one paragraph
Privacy risk is the chance that personal data is collected, used, shared, kept or exposed in a way the law, customers or employees do not accept. It comes in two forms. The first is a breach: data is stolen or exposed because access was too broad or controls failed, which triggers notification clocks, regulatory investigation, litigation and loss of trust. The second needs no attacker: data is used for a purpose nobody assessed, kept long after it is needed, shared with a vendor without a contract, or fed into an AI system without a lawful basis. Both are measured by regulators against one test, accountability: under GDPR Article 5(2) the controller must be able to demonstrate compliance with the data protection principles. A board that cannot see the evidence cannot know whether that test would be met.
Why this is a board-level issue now
- Fines are large and security failures are a main trigger. GDPR Article 83(5) allows fines of up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher, for breaches of the principles, data subject rights and international transfer rules; Article 83(4) allows up to 10 million euros or 2% for controller and processor obligations, which include security under Article 32 and breach notification under Article 33. DLA Piper's January 2026 survey reported about 1.2 billion euros of GDPR fines in 2025 and 7.1 billion euros since May 2018. See the GDPR Fines and Enforcement Statistics.
- Regulators judge security operations, not policies. The ICO fined Capita 14 million pounds in October 2025 after a breach affecting 6.6 million people, citing among other things that a high-priority security alert took 58 hours to respond to against a one hour target. It fined 23andMe 2.31 million pounds in June 2025, citing the lack of mandatory MFA after a credential stuffing attack (23andMe).
- Breach volumes are rising. The same DLA Piper survey reported an average of 443 personal data breach notifications a day across Europe in its 2025 to 2026 period, up 22% on the year before. GDPR Article 33 expects notification to the supervisory authority within 72 hours of becoming aware of a reportable breach.
- The UK regime has been updated. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the ICO states that all of its data protection provisions were in force by 19 June 2026. It changes areas such as legitimate interests, automated decision-making, cookies and complaints handling, and brings enforcement of the electronic marketing and cookie rules (PECR) under the Data Protection Act 2018 penalty regime. See the UK Data Act 2025 Guide.
- US state laws now require assessments and audits. California's regulations on cybersecurity audits, risk assessments and automated decision-making technology took effect on 1 January 2026. Risk assessments apply to qualifying processing from that date, with attestations due by 1 April 2028, and the first cybersecurity audit certifications are phased from 1 April 2028 to 1 April 2030 by business size. More than 20 states now have comprehensive privacy laws. See the California CCPA Cybersecurity Audit and Risk Assessment Regulations Guide and the US State Privacy Laws Guide.
- AI multiplies the exposure. Training, retrieval and agents move personal data into new systems and new vendors, often faster than assessments can follow. See the AI and GDPR Guide.
Who owns what
Privacy fails most often in the gap between a legal team that writes obligations and technical teams that never turn them into controls and evidence. The board should see clear ownership across these roles:
| Role | Accountable for | What the board should expect from them |
|---|---|---|
| Board | Risk appetite and oversight; accountability rests with the organisation as controller | At least annual review of privacy risk, regular metrics, challenge of major processing decisions |
| Executive owner (often general counsel or chief privacy officer) | The privacy programme, policies and regulatory relationships | A programme plan, a risk register and a view of regulatory change |
| Data protection officer (where required) | Independent advice and monitoring; GDPR Article 38(3) requires reporting to the highest management level and no instructions on DPO tasks | Direct, unfiltered reporting to the board or its risk committee |
| CISO | Security of processing (GDPR Article 32), breach detection and response | Evidence that access to personal data is controlled, logged and reviewed |
| Business and data owners | Lawful purpose, minimisation and retention for their processes | Completed records of processing and impact assessments for high-risk processing |
| Procurement and vendor owners | Processor contracts and transfers (GDPR Article 28, Chapter V) | A list of processors holding personal data, with contracts and transfer mechanisms |
Where identity decides privacy outcomes
Most real privacy failures come down to who, or what, could reach the data. People, service accounts, API keys, SaaS integrations and AI agents all hold access to personal data, and non-human access is usually the least reviewed. Three points matter at board level:
- Machine access is invisible in most privacy reviews: records of processing list systems and purposes, not the integrations and tokens that can export the data. The Snowflake customer breaches showed how credentials without MFA could unlock entire data warehouses.
- AI agents act on personal data with delegated access: a support or sales agent with broad CRM access can disclose records to the wrong person, a privacy breach without an attacker. See the AI and Privacy Guide.
- Least privilege is a data protection measure: GDPR Article 25 (data protection by design and by default) and Article 32 both point to limiting access to what each purpose needs.
Five questions for the board to ask
- Do we know what personal data we hold, where it is, and who and what can access it? A credible answer is a maintained record of processing linked to systems and access lists, including service accounts, integrations and AI agents, not a spreadsheet updated once a year.
- Which processing carries the highest risk to people, and has each one been assessed? Expect a list of data protection impact assessments (GDPR Article 35) and, in California, risk assessments, with dates and owners.
- If we discovered a breach at 5pm on a Friday, could we decide within 72 hours whether and whom to notify? Look for a tested process covering GDPR, UK GDPR and US state clocks, and the date of the last exercise.
- Which vendors and AI services process our personal data, and do we have contracts and transfer mechanisms for all of them? The answer should include SaaS integrations and AI tools adopted by business teams.
- Does our data protection officer report to us directly, and what did they last raise? If the board has never heard from the DPO, independence is in doubt.
Red flags in management answers
- "Legal has it covered": legal can define obligations but cannot produce access logs, encryption evidence or deletion records.
- "We are certified": an ISO/IEC 27001 certificate does not show lawful basis, minimisation or retention, and its scope may exclude the processing in question.
- Retention without deletion: a retention schedule exists but nobody can show data being deleted on time.
- No count of AI tools using personal data: shadow AI use is already moving data to new processors.
- Breach process never exercised: the 72 hour clock is easily lost to internal escalation.
- DPO inside security or IT: a DPO who takes instructions from the function they oversee is unlikely to be seen as independent.
What good looks like
| Area | Good practice evidence | Framework reference |
|---|---|---|
| Accountability and governance | Board-approved privacy policy, executive owner, independent DPO reporting | GDPR Art. 5(2), 24, 37 to 39; NIST SP 800-53 PM-18 |
| Data inventory | Records of processing linked to systems, data stores and access | GDPR Art. 30; NIST CSF 2.0 ID.AM-07 |
| Risk assessment | Impact assessments for high-risk processing, revisited on change | GDPR Art. 35; SP 800-53 RA-8; CCPA risk assessment rules |
| Access control | Least privilege for people, service accounts and agents; periodic reviews | GDPR Art. 25, 32; CSF PR.AA-05 |
| Security of processing | Encryption, MFA, logging and monitoring in place and tested | GDPR Art. 32; CSF PR.DS-01; ISO/IEC 27001:2022 Annex A 5.34 |
| Breach response | Tested notification process for all relevant jurisdictions | GDPR Art. 33, 34; CSF RS.CO-02 |
| Vendors and transfers | Processor contracts, transfer mechanisms, AI vendors included | GDPR Art. 28, Chapter V |
| Retention | Schedules enforced with evidence of deletion | GDPR Art. 5(1)(e) |
Decisions for the board
- Risk appetite for new uses of data: agree which uses (AI training, profiling, sharing with partners, monitoring of staff) need executive or board approval after an impact assessment.
- One programme or many: organisations operating in the EU, UK and several US states usually do better with one control set mapped to each law than with separate programmes per jurisdiction. See the Global Privacy Regulatory Map.
- Funding deletion: retention is the principle most often left unfunded; less data held means smaller breaches and cheaper compliance.
- Size matters: a small organisation needs a clear owner, an inventory, a breach process and processor contracts. A large or data-intensive organisation needs a DPO with resources, automated discovery of personal data, access reviews covering machine identities and a privacy engineering capability.
Where to invest first
- A data inventory linked to access: records of processing that show which systems, integrations and identities can reach each category of personal data. See the Data Mapping and ROPA Guide.
- Least privilege for the biggest data stores: remove broad human and machine access to customer and employee data, and require MFA on every path to it.
- Breach notification readiness: a tested process and decision log across jurisdictions. See the Data Breach Notification Checklist.
- Impact assessments for AI and other high-risk processing: before launch, not after. See the DPIA Guide.
- Retention enforcement: automated deletion for the largest data sets, with evidence.
Metrics to track
| Metric | Why it matters |
|---|---|
| Systems holding personal data covered by the record of processing (%) | You cannot protect or account for what is not mapped |
| High-risk processing activities with a current impact assessment (%) | Core accountability evidence |
| Human and machine identities with access to sensitive personal data, and the share reviewed in the last quarter | Access is the main driver of breach size |
| Time from detection to notification decision in exercises and real incidents (hours) | Measures readiness against the 72 hour clock |
| Data subject requests completed within the legal deadline (%) | A visible sign of operational control to regulators and customers |
| Data sets past their retention period (count, trend) | Shows whether retention is real |
Use the Privacy Programme Maturity Model to baseline progress and set a target level.
A 90-day plan
- Days 1 to 30: confirm the executive owner and the DPO's reporting line; list the ten largest stores of personal data and every human and machine identity with access; check the breach notification process has named decision makers for each jurisdiction.
- Days 31 to 60: remove unnecessary access to the top stores; list AI tools and vendors processing personal data and close contract gaps; identify high-risk processing without a current impact assessment.
- Days 61 to 90: run a breach notification exercise and time the decision; report the first metric set, gaps and a funded plan to the board; schedule California assessments and audit preparation where in scope.
Common failure patterns
- Compliance on paper: policies and records exist but do not match systems, so evidence fails at the first regulatory question.
- Security treated as separate from privacy: the Capita fine turned on security operations (alert response, privileged access), not on privacy notices.
- Weak authentication on customer accounts: credential stuffing against accounts without MFA, as in the 23andMe case, becomes a personal data breach.
- Machine access never reviewed: integrations and service accounts with bulk export rights outlive the projects that created them.
- AI adopted ahead of assessment: personal data reaches new processors through tools nobody assessed.
Practitioner checklist
- Executive owner named; DPO (where required) reports to the board or its risk committee.
- Records of processing linked to systems and to the identities with access.
- Impact assessments completed for high-risk processing, including AI uses.
- MFA and least privilege on every path to sensitive personal data, including service accounts and agents.
- Breach notification process tested for GDPR, UK GDPR and relevant US states.
- Processor contracts and transfer mechanisms in place for all vendors, including AI services.
- Retention schedules enforced with evidence of deletion.
- Data subject request process measured against legal deadlines.
- Regulatory change watch covering the UK Data Act, EU proposals and new US state laws.
Standards and references
- GDPR: Article 83, General conditions for imposing administrative fines
- EUR-Lex: Regulation (EU) 2016/679 (GDPR)
- ICO: The Data (Use and Access) Act 2025, what does it mean for organisations
- ICO: Capita fined 14 million pounds for data breach
- California Privacy Protection Agency: regulations on cybersecurity audits, risk assessments and ADMT approved
- NIST: Privacy Framework
- DLA Piper: GDPR Fines and Data Breach Survey, January 2026
How NHI Mgmt Group can help
We provide independent identity and non-human identity risk assessments and board briefings, focused on the service accounts, integrations, API keys and AI agents that hold access to personal data and are rarely covered by privacy reviews. Our NHI Foundation Level Training Course helps security, privacy and IAM teams govern machine access. Contact us to arrange a briefing.
Related NHI Mgmt Group resources: Privacy Programme Guide for Security Teams · UK GDPR and Data Protection Act 2018 Guide · Data Security and AI Executive Briefing · Privacy Programme Maturity Model. This guide summarises data protection obligations for board members and is not legal advice.