Research shows that a third of organizations experienced a data sovereignty incident last year. It is not a case of blind ignorance, though. Indeed, our own Data Sovereignty Report found that 44% of respondents describe themselves as “very well informed” about data sovereignty requirements.

Businesses know the rules. Yet, one in three of them got hit by a sovereignty incident anyway. That gap is the single biggest commercial opportunity in the UK channel right now. It’s getting worse, and the businesses that need help the most are the ones least equipped.

Why does this matter?

Customers don’t buy sovereignty from a vendor slide deck. They buy it from a trusted partner that maps their data flows, identifies where the architecture can’t enforce the policy promises, and builds a remediation plan that passes the audit.

Over four-in-ten (44%) businesses flag concerns about whether their cloud providers can genuinely guarantee sovereignty. Those concerns are well-founded, but the question most customers are asking is the wrong one. It shouldn’t be “where is my data stored?

Ring-fencing data by geography is neither new nor technically difficult. What is far harder, and most customers have never genuinely confronted, is the question of legal jurisdiction.

Consider the architecture that many on these shores believe is sovereign. A major US cloud provider may operate a German-based subsidiary, staffed by EU nationals, marketed explicitly as a sovereign offering. But the parent company remains subject to US law, and no subsidiary structure changes that. A lawful US warrant, a trade embargo, or an executive order doesn’t stop at the border of a local data centre.

Plus, events that would have seemed far-fetched a few years ago (sweeping trade disputes, unilateral policy shifts, foreign data access demands) are no longer theoretical. They are the operating environment of today. And if any of those scenarios materialise, clients and MSPs relying on a geo-residency promise could face real, material exposure.

Target the mid-market

It is the mid-market where the real urgency lives. Sovereignty maturity generally scales with organization size. Among companies with over 20,000 employees, roughly 45% spend above £5 million annually. At the other end, organizations with 500 to 999 employees sit at just 19% in high-tier spending.

Large enterprises often have internal sovereignty teams and dedicated compliance architects. Mid-market organizations, however, have the same regulatory obligations and enforcement exposure, yet only a fraction of the resources. They are the ones that need a partner who can deliver sovereign infrastructure without requiring them to hire a team of specialists to run it.

And time is ticking. GDPR fines now exceed €5.6 billion, and the EU AI Act introduces penalties up to €35 million or 7% of worldwide turnover. For a UK business operating in Europe post-Brexit, the regulatory surface area has never been larger.

Four questions to consider...

These are the key questions you need to get your customers asking themselves.

• Which legal jurisdiction ultimately governs our data? A cloud provider can locate a data centre here and market it as a sovereign offering. But they are still subject to the laws of the country where the parent company is headquartered. If a lawful warrant, a trade dispute, or a government access demand lands on that parent company, the local subsidiary’s address offers limited protection. Jurisdiction follows the entity, not the building.
• Who controls the encryption keys? If the provider retains the ability to decrypt customer data, the customer doesn’t have sovereignty. They have a residency promise with a legal back door. Sole encryption key ownership, retained within the customer’s environment, is the line between sovereignty that holds and sovereignty that folds under a government access request.
• Where is data processed, not just stored? Cloud platforms can store data here in the UK, yet process it abroad without the customer knowing. For regulated industries, that invisible border crossing is a compliance violation waiting to happen.
• Can you prove it? Regulators and procurement teams no longer accept “we believe we’re compliant.” They want immutable audit trails, residency logs, and compliance documentation produced on demand. That’s the shift from stated compliance to provable control.

Channel partners should look at this as an architecture engagement. Map the data flows. Deploy a platform that enforces residency at the infrastructure level, retains key custody in-jurisdiction, and generates audit evidence. That’s a services-rich, high-value, recurring-revenue conversation. Plus, it renews, because sovereignty isn’t a project. It’s a permanent operating condition.

The conversation to have

Partners winning the sovereignty conversation are the ones leading with the jurisdiction question, targeting the mid-market, and building sovereignty practices that go beyond the data map.

The data doesn’t lie. What separates the firms that avoided incidents from those that did is operational depth. Architecture, controls, and evidence.

However, what will separate the channel partners that will win in the future will be something more foundational. It’s all about the willingness to have the conversations that the vendors won’t.

As the Digital Operational Resilience Act (DORA) and the Network and Information Systems Directive 2 (NIS2) reshape Europe’s regulatory landscape, data sovereignty is no longer a legal abstraction - it is becoming a practical and operational responsibility for Managed Service Providers (MSPs).

Customers are no longer asking where their data is stored. Instead, they are asking who controls it, how quickly it can be recovered, and whether that recovery will stand up to regulatory scrutiny.

These questions are landing directly with service providers managing SaaS applications, backup, and critical data environments. Sovereignty is no longer a compliance checkbox; it needs to be a core part of the service MSPs are expected to deliver.

From infrastructure management to data custodianship

For many organizations, MSPs now sit at the center of the data protection strategy. They manage SaaS environments, oversee backup, and ensure continuity in the event of disruption. This shifts their role significantly, meaning MSPs are no longer just operators of infrastructure; they are custodians of data control.

The challenge is that sovereignty is still often framed as a question of jurisdiction. However, in reality, it is operational. It depends on whether data can be accessed, controlled, and recovered when systems fail or access is lost.

From uptime and capacity to resilience

Historically, MSP offerings have been built around availability, performance, and cost efficiency. Uptime and capacity defined value, and backup was often treated as a background function.

That model is changing.

Regulation and customer expectations are driving a move toward demonstrable resilience. It is no longer enough to say data is protected - MSPs must prove that it can be recovered, within defined timeframes, and under real-world conditions.

Operational data reinforces this shift. We recently published the Keepit Annual Data Report 2026, which shows that:

• Some 90% of restore actions are single-file recoveries, reflecting how frequently real-world data loss occurs
• Most restore activity happens during working hours, highlighting that recovery is an everyday operational need, not a rare event

Resilience is not theoretical; it is tested daily in small but critical ways, and MSPs are increasingly expected to support that reality.

The hidden dependency risk in SaaS

The widespread adoption of SaaS has made recovery more complex.

Most organizations rely on multiple SaaS platforms to run critical parts of their business, often assuming those platforms provide comprehensive data protection. In reality, responsibility is shared.

SaaS providers ensure availability, but long-term data protection and recoverability often sit elsewhere. For MSPs, this introduces a dependency risk that is not always visible to customers.

If access to a SaaS platform is disrupted, whether by cyber incident, misconfiguration, or outage, recovery may be constrained by the platform itself. This creates the sovereignty gap: the difference between having data stored somewhere and having meaningful control over it when it matters most.

A maturity gap and an opportunity to guide readiness

Restore behavior scales with organization size, according to our research. Indeed, 28% of SMBs restore regularly, versus 91% of commercial and 95% of enterprise organizations.

This is often a natural outcome of resourcing - larger firms have more dedicated IT capacity, while SMBs may treat restores as an “as-needed” task. Even major outage events didn’t produce a measurable increase in restore testing, showing that awareness alone doesn’t create routine readiness.

That’s where MSPs and vendors can make the difference: lightweight, guided recovery checks that build confidence quickly and raise maturity over time - supported by assistance that helps admins take the right steps when it matters.

Designing services for sovereignty

Closing the sovereignty gap requires a rethink of service design.

Sovereignty cannot be addressed through policy alone. It must be embedded into how services are built and delivered. That means:

• Ensuring data can be recovered independently of the primary SaaS environment
• Reducing reliance on single vendors or platforms
• Regularly testing recovery processes
• Providing customers with clear visibility into recovery capabilities

It also means answering increasingly detailed questions. What happens if access to a SaaS platform is lost? How quickly can data be restored? Where are the dependencies in the recovery chain?

These are no longer theoretical scenarios. They are becoming part of standard due diligence, particularly in regulated industries.

From service provision to assurance

As expectations evolve, so too does the role of the MSP. Providers are moving beyond managing infrastructure to delivering assurance.

Customers are no longer simply buying services; they are seeking confidence that their data is protected, operations remain uninterrupted, and regulatory obligations are met.

Conversations that once centered on speed, capacity, and cost are now shifting toward reliability, governance, and responsibility.

For MSPs, this shift presents a clear opportunity. Those who can define and deliver a credible sovereignty strategy will stand out in a market where performance alone is no longer enough. The ability to demonstrate ownership, stability, and continuity is becoming the differentiator.

Sovereignty redefined

Data sovereignty is evolving. It is no longer defined solely by where data resides, but by whether organizations can truly manage and restore it when it matters most.

For MSPs, this is a turning point. Those that move beyond uptime and capacity, and instead design for continuity, autonomy, and restoration, will be best placed to meet both regulatory demands and rising customer expectations.

Enterprises across the UK are contending with “critical blind spots” over what workers are sharing with AI applications, according to new research.

A survey from SailPoint found more than two-thirds (67%) of organizations can’t account for the information staff are sharing with AI platforms and large language models (LLMs).

Worse still, the study noted that 35% of respondents admitted to sharing data through external tools, rather than approved internal applications, which is creating an array of risks for enterprises.

The rise of ‘shadow AI’ has become a recurring pain point for organizations over the last two years. Workers using unauthorized applications risk exposing sensitive company data, research shows – and there’s no sign of the trend slowing down.

Research from Gartner in November 2025 predicts that 40% of enterprises will suffer a data breach due to shadow AI by 2030.

SailPoint noted that the growing shadow AI trend comes in spite of the fact many enterprises are investing heavily in data management and AI capabilities for staff.

More than four-in-five respondents (82%) said they have invested in additional staff and skills training to help workers better manage AI applications, while 41% have brought on dedicated AI and analytics personnel.

Notably, nearly half (45%) of IT leaders said they still lack visibility on where information is being shared, and how.

Agentic AI poses new governance challenges

Mark McClain, CEO and Founder at SailPoint, said the findings show AI can often represent a catch-22 for organizations. While these tools are helping staff, they’re now creating additional risk surfaces for security teams.

“AI tools can enhance productivity, but they also create serious risk when they operate outside an organization’s visibility and governance,” he said.

“When sensitive information is entered into unapproved models, it can be exposed, mishandled, or even amplified through errors and hallucinations.”

McClain warned that with the rise of agentic AI, poor data management practices could be further amplified and put businesses at greater risk.

SailPoint noted that the need for greater visibility and oversight is now a priority for many enterprises on account of growing risks. In a previous study from SailPoint, four-in-five organizations (80%) revealed that AI agents had performed “unintended actions” such as accessing or sharing inappropriate data.

UK businesses are adding as many as 10,000 agents and machine identities each month, the company noted, meaning security teams could quickly become overwhelmed.

"As use of AI systems becomes more widespread, the situation is only going to get more out of control if organizations fail to put the right guardrails in place – compounded by other tools flying under the radar,” McClain commented.

“Organizations need to stop workarounds and regain control. That takes a combination of skills and awareness, but it also fundamentally boils down to a challenge around identity”

FOLLOW US ON SOCIAL MEDIA

European policymakers are increasingly concerned about digital sovereignty, calling for the development of a technology ecosystem that's less dependent on big US tech firms.

At workspace platform Wire’s recent European Digital Sovereignty Summit in Brussels, MEPs, industry leaders, and digital experts called for the creation of a digital ecosystem reflecting what they described as European – rather than US – business values: democracy, transparency, and interoperability.

“Reducing reliance on foreign tech infrastructure is key to protecting democratic stability and data sovereignty, particularly given geopolitical risks," said Wire CEO Benjamin Schilz.

"Open source, interoperability and transparent standards are essential to build trust, avoid vendor lock-in, and strengthen resilience.”

Participants highlighted the risks of concentrated browser ownership, reliance on foreign cloud providers, and governance vulnerabilities within major platforms.

Notably, however, sovereignty must not mean isolation: Europe should remain open and globally engaged but anchored in its own standards and safeguards.

Jean-Phillipe Scherer, head of EU/NATO Public Affairs for Defence and Space at Airbus, called for a broader mindset shift through more European leadership and education.

“Individual priorities, rather than national sovereignty, are the greater barrier to European cooperation,” he said.

There were calls for practical reforms, stronger alignment across AI, semiconductor and cybersecurity policy, and for simplification within a deeper single market.

Strained relations create uncertainty

The unpredictability of the Trump administration in the US has intensified calls for European digital sovereignty, with figures including European Commission President Ursula von der Leyen and former head of the European Central Bank Mario Draghi, calling for action.

Just last week, the European Council proposed new regulations aiming to reduce dependence on US firms. This includes new proposals to “simplify the EU’s digital legislative framework and the implementation of harmonized rules on AI”.

“Streamlining the AI rules is essential for ensuring the EU’s digital sovereignty," said Marilena Raouna, deputy minister for European affairs of the Republic of Cyprus.

"The proposal will bring greater legal certainty, make the rules more proportionate and ensure more harmonised implementation across member states."

In the UK, calls are growing for a stronger focus on digital sovereignty, with industry stakeholders harboring significant concerns on transatlantic overreliance.

A survey of over 1,000 UK IT leaders from Civo last year found that more than 60% believed the UK government should cut its use of US cloud services.

Key concerns included exposing the country’s digital economy to significant risks with regard to data security, and the impact providers have on the domestic cloud industry.

The Atlantic Council recently warned that Trump’s close connections with leading tech executives means that the US administration’s combative posture toward European tech regulation is likely to continue causing friction.

"Whether a continued focus by the Trump administration on Europe’s digital rules will create an even stronger push in Europe for an exclusive form of digital sovereignty is not yet evident," commented fellows Frances Burwell and Kenneth Propp.

"What is clear is that without some guidelines, such as those offered in the conclusions to this report, the European Union and United States might find that their differences regarding digital sovereignty and digital rules make creating and maintaining an open transatlantic digital marketplace much more challenging."

Big tech is acting

Aware of the issue, US tech firms are making efforts to calm European business concerns, particularly with the launch of dedicated sovereign cloud services,

Amazon Web Services (AWS), Microsoft, and Google Cloud have all made moves on this front. Yet despite proactive efforts, lingering doubts still persist.

As these companies are subject to the US Cloud Act, which allows US law enforcement to demand access to data – even when that’s stored outside the US – European industry stakeholders continue to voice concerns.

Last year, Microsoft president Brad Smith claimed the tech giant would take the US government to court if forced to comply with data requests by the US administration.

FOLLOW US ON SOCIAL MEDIA

Security experts have warned about the dangers of ‘shadow AI’ after the interim chief of the Cybersecurity and Infrastructure Security Agency (CISA) uploaded sensitive documents to a public version of ChatGPT.

According to reports from Politico, Madhu Gottumukkala uploaded documents to the popular AI tool despite it being blocked for other DHS employees at the time.

The incident prompted an “internal review” after triggering security features designed to prevent theft or mistaken disclosure of government materials, sources told the publication.

While this review found none of the files uploaded to the chatbot were classified, they did include CISA contracting documents marked “for official use only”.

CISA’s director of public affairs, Marci McCarthy, told Politico that Gottumukkala was granted permission to use ChatGPT “with DHS controls in place,” adding that use of the chatbot was “short-term and limited”.

Alastair Paterson, CEO and co-founder at Harmonic Security, told ITPro that the incident is concerning and highlights the potential for AI-related blunders even in tightly controlled environments.

“It’s obviously embarrassing but not without precedent,” he said. “When DeepSeek launched it was reported that staff at the Pentagon used it for days before it was blocked. It shows that any organization is susceptible to the risk of shadow AI and the need for urgent controls.”

Shadow AI is becoming a serious problem

Despite there being no serious ramifications in the wake of the blunder, security experts nonetheless told ITPro that uploading sensitive information to unauthorized tools can pose serious risks to organizations.

This is an issue that has grown significantly over the last three years, with the increased use of AI in the enterprise giving rise to concerns about ‘shadow AI’.

This refers to the use of AI tools that haven’t been expressly authorized by security teams, meaning they can’t keep track of documents or potentially sensitive corporate information uploaded to the chatbots.

A recent survey from BlackFog, for example, found that nearly half (49%) of workers admitted to having used AI tools in the workplace without approval, often sharing sensitive data with free versions of popular solutions like ChatGPT.

Carl Wearn, head of threat intelligence analysis and future ops at Mimecast, told ITPro that the shadow AI practices have serious long-term implications for data protection and cybersecurity.

“The risk itself is straightforward but serious. Once contracts, emails, or internal documents are entered into a public AI model, control is lost in seconds,” he said.

“There’s often no clear way to retrieve that data or understand where it may surface next.”

In most cases, Wearn noted that there’s “no malicious intent” and workers are simply being careless. This is, at least in part, due to demands placed on workers “in the name of efficiency”.

“Shadow AI is accelerating because people are under pressure to move faster,

not because they are careless,” he told ITPro.

Leadership needs to take responsibility

While these activities are prevalent among workers, research shows leadership figures are also engaging in - and even encouraging - dangerous shadow AI practices.

BlackFog’s survey found more than two thirds (69%) of C-suite members said they’re happy to prioritize speed over privacy in many cases, signaling somewhat of a seal of approval for workers to engage in risky practices to speed up processes.

Wearn noted that management figures should lead by example on this front by engaging with staff to set clear guidelines.

“Leadership, accountability, and clarity now matter just as much as the technology itself,” he said. “Organizations that establish governance frameworks today will be better positioned to harness AI’s benefits while protecting what matters most.”

FOLLOW US ON SOCIAL MEDIA

The late Donald Rumsfeld famously divided problems into three: known knowns, known unknowns, and the unknown unknowns.

For the former US Secretary of Defense, known knowns were risks we know about; known unknowns as “things we know… we do not know”. And unknown unknowns were those problems “we don’t know we don’t know”.

Rumsfeld believed that unknown unknowns posed the gravest threats to the US and its allies. But when it comes to organizations keeping their operations running, “sovereign” control over their systems is increasingly, a known unknown. We know there is a risk with digital sovereignty, but as yet, it is not clear where that risk lies.

Recent world events have brought geopolitical risks to the fore. And, over the last few years the risk that governments, or a vendor working to a government’s orders, could cut off an organization from its technology or deny access to their data, has moved firmly into the realm of the possible.

There is an ongoing debate about whether Chinese vendors in particular have granted their government back-door access to their systems (the vendors strenuously deny this). And lately, western analysts have expressed concern about “kill switches” in Chinese-made electric vehicles including London buses, solar power invertors and other critical equipment.

But concerns about access to data come from the other side of the world. Legislation, such as the US CLOUD Act (Clarifying Lawful Overseas Use of Data) allows US law enforcement agencies to demand that US vendors hand over data, even when it is stored outside the United States. This puts US legislation in direct conflict with regulations such as GDPR.

At the same time, European rules, such as the EU’s Cloud Sovereignty Framework, propose strategic, legal and jurisdictional, and data and AI sovereignty for cloud systems. All this could mean that enterprises are no longer able to simply host their data, or run systems, in the way that best suits their budgets or operational requirements.

Fundamental questions

Where systems are, and where data reside, are now fundamental questions. And these are not easy questions for CIOs to answer.

“Data sovereignty is about where your data sits, and who has jurisdiction over it,” explains Moona Ederveen-Schneider, founder of Resilia Connect, a consultancy. “Digital sovereignty is far more expansive: it is about control over the entire technology stack, cloud infrastructure, operating systems, chips, telecoms networks, and increasingly AI models. You can have data sovereignty without digital sovereignty, but not the reverse,” she tells ITPro.

Laws and regulations, though, are not the only reasons for concern about sovereignty. As Ederveen-Schneider points out, high-profile outages and cyber attacks have forced organizations to reconsider whether they have any real strategic autonomy. “We are seeing the collision of technology and geopolitics,” she says. “Single vendor dependency looked like an efficiency gain until it became a national security risk.”

Organizations in Europe (including the UK) are now largely aware of the need for data sovereignty, not least because of GDPR.

But broader digital sovereignty is more difficult. And full technology sovereignty might not even be possible, or at least not on terms commercial organizations could bear. Achieving technology sovereignty would mean going all the way down the technology stack, ultimately to the level of rare earths and chip foundries, as well as the energy needed to power them.

“No country anywhere in the world can at this point in time have technology sovereignty,” warns Martha Bennett, VP principal analyst at Forrester. “It would probably be feasible for the US or the EU to get a degree of sovereignty that is currently unprecedented, but it would cost,” she tells ITPro. “Sovereignty is about control, but what degree of control do you require, and how realistic is it for you to get that control?”

“Depending on what your requirements are, there might not even be any cloud provider in Europe that can support what you need. So that needs to be built,” she cautions. “Even if it is there, there are not the same economies of scale. It always comes back to costs: what are you prepared to pay for.”

The barriers to sovereignty, then, are both cost and practicalities. Infrastructure and technology, from physical facilities and energy to software stacks and APIs, might not be available.

Where they are, they cost more. “Fragmenting procurement requirements mean enterprises might need different cloud providers for different markets, and sovereign alternatives often cost 15-30% more,” says Ederveen-Schneider. But this is not a niche compliance issue. It is reshaping how multinationals operate.”

Nonetheless, the drive towards digital sovereignty, or strategic autonomy, has prompted organizations to reconsider both their cloud and their software strategies.

Sovereignty, autonomy and compromises

Moving hosting away from (US-based) hyperscalers is increasingly possible, but comes with higher costs and potentially, less advanced technology.

Vendors, including the cloud hyperscalers, have responded by creating availability zones and regions within Europe. SaaS providers give European businesses the option to host data within the EU or UK.

In 2025 alone, Microsoft launched a cloud sovereignty scheme, Google expanded its sovereign cloud services to cover over 42 cloud regions and announced UK residency for agentic AI services. AWS kicked off 2026 by making its European Sovereign Cloud generally available for enterprises.

Others made similar moves, such as Linux distributor SUSE which launched a standalone data sovereignty unit.

“We like cloud, but you need something else,” Kim Larsen, CISO at Keepit, a cloud and data protection provider with a significant European presence, tells ITPro.

“What is the sanity in putting critical data in the cloud? That depends on which cloud you are using and if it suddenly becomes subject to political manoeuvres.”

He points to vendor-independent clouds and physical and logical separation between production and backup data as keys to autonomy, if not sovereignty.

Hardware companies, and data storage vendors in particular, also increasingly promote sovereignty as one reason to host at least some data in-house, rather than on the public cloud.

Moving from proprietary software to open source could also reduce the risk of a government restricting access to essential technology. But this is not guaranteed. “Going for open source doesn’t necessarily address your sovereignty problem, if you pick a piece of software where the sole maintainer is Dmitry in Moscow,” Bennett warns.

To address these challenges, analysts at Forrester have developed a concept of “minimum viable sovereignty”. Here, organisations set out the technology requirements they need, map these against what the markets offer and, of course, the costs.

As author Dario Maisto points out, “not every workload requires sovereign infrastructure – and overengineering can be costly and inefficient.”

Even so, the need for digital sovereignty looks set to move from a known unknown, to known known, in the coming year.

Fears over unverified AI-generated data are pushing organizations to implement a zero trust posture for stronger data governance.

Large language models (LLMs) are typically trained on web-scraped data, and as the use of generative AI grows these sources increasingly contain AI-generated content.

This is set to accelerate in the coming years, according to Gartner. Analysis from the consultancy found 84% of respondents expect their organization to increase funding for generative AI in 2026 – meaning that the volume of AI-generated data will continue to rise.

As a result, future generations of LLMs will increasingly be trained on outputs from previous models – outputs that may be inaccurate or biased. This means an ever-heightening risk of “model collapse,” where AI tools’ responses may no longer accurately reflect reality.

"Organizations can no longer implicitly trust data or assume it was human-generated,” said Wan Fui Chan, managing VP at Gartner.

“As AI-generated data becomes pervasive and indistinguishable from human-created data, a zero trust posture establishing authentication and verification measures is essential to safeguard business and financial outcomes.”

By 2028, Gartner found the proliferation of unverified AI-generated data is set to have prompted 50% of organizations to have implemented a zero trust posture for data governance.

Active metadata management practices will become a key differentiator for firms, the consultancy said, and organizations should consider taking several strategic actions.

How to approach a zero trust data governance strategy

According to Gartner, IT leaders should appoint a dedicated AI governance leader, responsible for AI governance, including zero trust policies, AI risk management, and compliance operations.

This person should work closely with data and analytics (D&A) teams to make sure that both AI-ready data and systems are capable of handling AI-generated content.

Cross-functional teams should also be established, including cybersecurity, D&A, and other relevant stakeholders.

These teams will carry out comprehensive data risk assessments to identify business risks related to AI-generated data - and decide which activities need new strategies.

Elsewhere, building on current D&A governance frameworks will be crucial to tackling the issue, according to Gartner. The creation of new or updated frameworks will focus primarily on updating security, metadata management, and ethics-related policies to address new risks arising from AI-generated data.

Regulatory compliance challenges are afoot

As AI-generated content becomes more prevalent, Chan warned that regulatory requirements for verifying ‘AI-free’ data are likely to intensify.

Crucially, these could differ significantly across geographies, posing serious compliance challenges.

“In this evolving regulatory environment, all organizations will need the ability to identify and tag AI-generated data," he warned.

"Success will depend on having the right tools and a workforce skilled in information and knowledge management, as well as metadata management solutions that are essential for data cataloguing.”

FOLLOW US ON SOCIAL MEDIA

The UK government has reportedly renewed its demand that Apple provide it with backdoor access to encrypted iCloud user data.

Earlier this year, it backed down on the issue after a furious response from Donald Trump. Apple, meanwhile, withdrew its most secure cloud storage service, iCloud Advanced Data Protection, from the UK in response.

Now, though, according to the Financial Times, the government is once again asking for access. This time, however, the technical capability notice (TCN) would apply only to the data of British citizens, rather than worldwide.

Both Apple and the Home Office are restricted by law from discussing the TCNs, which are issued under the UK Investigatory Powers Act.

Trump described the UK's earlier demands as 'something that you hear about with China' – and the Electronic Frontier Foundation (EFF) is inclined to agree, saying that the new TCN is just as dangerous as the first.

"As we've said time and time again, any backdoor built for the government puts everyone at greater risk of hacking, identity theft, and fraud," said EFF security and privacy activist Thorin Klosowski.

"It sets a dangerous precedent to demand similar data from other companies, and provides a runway for other authoritarian governments to issue comparable orders."

According to the FT, the US is no longer pushing the UK government to drop its demands. However, said Matthew Sinclair, UK senior director of the Computer and Communications Industry Association (CCIA), the government's decision to limit its request to UK data doesn't answer concerns.

"It is very concerning that reports again suggest that the Home Office is undermining security for British users of important cloud services," he said.

"Even if some changes have been made to reduce the extra-territorial impact, it is clear that any vulnerability will have implications beyond the UK's borders, creating a weak link in global efforts to improve security online. Changes to this law are urgently needed to stop this fundamental threat to encryption and ensure that the UK is not holding up important security improvements."

And, said Privacy International, end-to-end encryption can't be removed from iCloud services for the UK only when those services are used worldwide.

"Unless Apple plans to build walled-off systems just for UK users, so it can then undermine the security of UK users alone for the UK government, then this new order could have a quite similar impact to the old one," it said.

"This could also put at risk information like user passwords, location, and health data. By using a secret order to undermine the security of Apple products, the UK government is making security harder for us all."

And, it warned, "If this new order isn't stopped, the UK government will likely issue similar orders to other companies, too."

MORE FROM ITPRO

• I think the UK government's attempt to strong-arm Apple into giving it an ADP backdoor is a travesty – and so does most of the industry

Digital sovereignty is an issue that has been bubbling away in the background of IT for some time but doesn’t often see the limelight. In this episode of the ITPro Podcast, we’ve decided to change that.

From sovereign clouds to AI, Jane McCallion and Ross Kelly dig into what digital sovereignty is, how it’s being used, and its relationship with AI, cloud, and national data regulations.

Highlights

“The World Economic Forum describes digital sovereignty as the ability to have control over your own digital destiny andI think that's a really great way of describing it. And when you look at how the EU has positioned itself in recent years, that certainly is the key focus there – it's all about … maintaining control.”

“You can't understate the impact of regulatory compliance in the EU – that's the huge driving factor, Microsoft, AWS, Oracle, Google Cloud, they wouldn't be bending over backwards if they didn't know the risks there. And for individual organizations as well as customers of these providers, they're the ones that are pushing for this because they're conscious of their compliance as well.”

Related links

• Sovereign cloud services are now the “bare minimum” expected by customers, and hyperscalers are scrambling to meet demand
• What the new Microsoft Sovereign Cloud push means for European customers
• AWS says only Europeans will run its European Sovereign Cloud service
• What is a sovereign cloud?
• SAP wants to take data sovereignty to the next level with new 'on-site' infrastructure options
• HPE launches exclusive sovereign cloud offering for the channel

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Join us on LinkedIn

What happens when the system that keeps your business running goes down? Active Directory is the backbone of enterprise identity and access management, authenticating millions of users worldwide. If AD goes offline, so does the business - making it a prime target for attackers.

Are you prepared for the worst-case scenario?

Join Commvault experts for an immersive webinar where we'll simulate a real-world Active Directory outage. Witness the cascading effects of AD failure and learn how to accelerate the restoration of AD—and business operations—fast. Discover tools and tactics to streamline recovery, minimize downtime, and protect access to essential systems.

Bonus:
Get a live demo of Commvault’s upcoming automated AD forest recovery solution!

Key Takeaways:

Why AD protection and recovery should be a top priority.

The critical role AD recovery plays in your overarching cyber recovery plan.

How to automate AD recovery to minimize downtime and get the business back online fast.

The Data (Use and Access) Act has received royal assent and has now become law, with its various provisions coming into force over the next 12 months.

Updating the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA), and the Privacy and Electronic Communications Regulations (PECR), it sets out how personal information can be used for research.

It loosens restrictions on some automated decision making, makes provisions for using some cookies without consent, and allows charities to send people electronic mail marketing without consent in certain circumstances. It also requires organisations to have a data protection complaints procedure and introduces a new lawful basis of recognised legitimate interests.

"For too long, previous governments have been sitting on a goldmine of data, wasting a powerful resource which can be used to help families juggle food costs, slash tedious life admin, and make our NHS and police work smarter," said technology secretary Peter Kyle.

"These new laws will finally unleash that power for hardworking people – putting cash back in pockets and boosting vital public services, all part of our Plan for Change."

The government is pushing the benefits to the NHS, saying it will ensure that healthcare information, such as a patient's pre-existing conditions, appointments, and tests, can easily be accessed in real time across all NHS trusts, GP surgeries, and ambulance services, no matter what IT system they're using.

Enabling data sharing across platforms, it said, will save NHS staff 140,000 hours a year in admin tasks.

"No longer will patients be left waiting needlessly for treatment as NHS staff battle 'computer says no' bureaucracy," said secretary of state for health and social care Wes Streeting.

"We're making it easier for GPs, nurses, and paramedics to access the information they need, when they need it, safely, securely, and at speed."

The Act gives the Information Commissioner's Office (ICO) new powers, including the ability to compel witnesses to attend interviews, request technical reports, and issue fines of up to £17.5 million or 4% of global turnover under Privacy and Electronic Communications Regulations (PECR).

The ICO has published a catalogue of resources to help explain what this new legislation means for businesses.

"Over the coming months we will launch new guidance, open consultations, and provide practical tools to help embed the Act's principles into everyday operations," said information commissioner John Edwards.

"Our goal is to ensure that data can be used confidently and responsibly to deliver better services, drive economic growth, and uphold public trust."

Organizations, said the ICO, should prepare by familiarizing themselves with the changes, making sure they're doing enough to satisfy the new explicit requirements for online services that children are likely to use and, if necessary, overhauling their complaints procedures.

There's more information from the government here.

Endpoint management provider NinjaOne has completed its acquisition of Dropsuite in a deal valued at $270 million.

Founded in 2011, Dropsuite specializes in SaaS backup and data protection for critical workloads, covering cloud backup, archiving, and recovery. Geared towards MSPs, the cloud platform is designed to protect data, ensure business continuity, and simplify compliance.

NinjaOne said the acquisition will help customers minimize ransomware risks by unifying endpoint, server, and SaaS application backup capabilities.

In an announcement, Sal Sferlazza, NinjaOne’s CEO and co-founder, described the addition as “a major step forward” in the firm’s efforts to help customers improve productivity, protect data, and build resilience.

“The addition of Dropsuite not only expands the backup protection we offer, but it also brings a team of new Ninjas whose mindset perfectly aligns with NinjaOne’s values,” he explained.

“Dropsuite’s commitment to customer success and product excellence will help us accelerate growth and better serve our customers. I couldn’t be happier to welcome our new team members to NinjaOne.”

NinjaOne targets unified ransomware protection

The acquisition comes at a time when many organizations still possess fragmented backup strategies, tools, and teams due to large amounts of endpoints, cloud applications, remote devices, and SaaS platforms.

Phil Hochmuth, program vice president at research firm IDC’s Endpoint Management & Enterprise Mobility division, said this disjointed approach introduces unnecessary complexities in IT and security.

“Amid surging ransomware attacks, many organizations have a fragmented backup strategy with a patchwork of legacy endpoint tools, bolt-on SaaS protectors, and disconnected consoles,” he said.

“This approach introduces inefficiencies and blind spots and increases the risk of operational disruptions and intentional and unintentional data loss from human error, application issues, disgruntled employees, and cyber attacks.”

Dropsuite acquisition will boost customer safety

With Dropsuite’s integration into the NinjaOne portfolio, the firm can now offer a unified backup suite capable of providing secure automated backups across endpoints, servers, Microsoft 365, and Google Workspace, alongside real-time archiving.

By unifying these use cases into a single platform, NinjaOne said organizations of all sizes can now simplify their workloads whilst leveraging robust data protection, simplified backup workflows, as well as enhanced security and compliance.

“Dropsuite helps organizations protect their data with intuitive yet powerful cloud backup software,” commented Charif El-Ansari, CEO at Dropsuite.

“Together with NinjaOne, we’re even better suited to make our customers successful with one integrated console that automates endpoint and SaaS application backup. We will continue to solve our customers’ biggest challenges together.”

MORE FROM ITPRO

• NinjaOne secures $500 million investment at $5 billion valuation
• NinjaOne unveils new channel program to drive partner growth
• Ransomware remediation: What steps should your business take for recovery?

Almost half of office workers say they're using AI tools that aren't provided by their employer, with nearly a third keeping it a secret.

For 36%, the reason is that they feel it gives them a secret advantage, while three-in-ten worry their job may be cut. More than a quarter say they're suffering from AI-fueled imposter syndrome, saying they don’t want people to question their ability.

Findings from Ivanti's 2025 Technology at Work Report: Reshaping Flexible Work show that the use of AI at work is rising, with 42% of employees now using the technology in their daily workflow in 2025.

This, the study noted, marks a significant increase compared to the year prior, in which just one-quarter said they use AI in their role.

IT professionals are even keener on AI, with three-quarters using it. But even though they'd be expected to be more aware of the security risks, 38% are still using unauthorized tools.

This growing trend of covert AI use is a serious cause for concern, Ivanti noted, and as such bosses need to begin cracking down on the practice.

"Employees are using AI tools without their bosses' knowledge to boost productivity. It is crucial for employers to assume this is happening, regardless of any restrictions, and to assess the use of AI to ensure it complies with their security and governance standards," said Brooke Johnson, Ivanti chief legal counsel and SVP of HR and security.

"Employees adopting this technology without proper guidelines or approval could be fueling threat actors, violating company contracts, and risking valuable company IP."

Shadow AI could cause a security disaster

Ivanti warned that the use of unauthorized AI tools at work is putting many organizations at risk - and it isn’t the only study in the last year to emphasize the dangers.

Research from Veritas Technologies, for example, found that 38% of UK office workers said that they or a colleague had fed an LLM sensitive information such as customer financial data.

However, six-in-ten failed to realize that this could result in the leaking of confidential information and breach data privacy compliance regulations.

Meanwhile, analysis from BCS last year warned that staff using non-approved tools risk breaching data privacy rules, exposing themselves to potential security vulnerabilities, and even falling foul of intellectual property rights.

"To mitigate these risks, organizations should implement clear policies and guidelines for the use of AI tools, along with regular training sessions to educate employees on the potential security and ethical implications," said Johnson.

"By fostering an open dialogue, employers can encourage transparency and collaboration, ensuring that the benefits of AI are harnessed safely and effectively."

A raft of major firms have already cracked down on the use of AI at work, most notably Apple, which implemented strict controls on the use of ChatGPT not long after it launched in late 2022.

Amazon and JP Morgan also implemented similar policies while Samsung took drastic action after discovering an accidental leak of sensitive information by an engineer who uploaded code to the popular chatbot.

But it's not just a question of policies, said Johnson. Indeed, organizations need to do more to monitor whether they're actually being implemented.

"Employees are using AI tools without their bosses' knowledge to boost productivity," she said.

"It is crucial for employers to assume this is happening, regardless of any restrictions, and to assess the use of AI to ensure it complies with their security and governance standards."

MORE FROM ITPRO

• The best AI tools for businesses to try today
• AI coding tools are finally delivering results for enterprises
• AI tools are growing in popularity at enterprises, but not all of them are approved by employers

The UK's data protection authority has apologized for being slow to respond to data protection complaints, saying it's been overwhelmed by increased workloads.

In the last quarter of 2024, the Information Commissioner’s Office (ICO) responded to just 12% of complaints within 90 days, figures show, well down on its 80% target.

The figure was 65% at the beginning of last year, and has been dropping steadily since the fourth quarter of 2023, when it was 88%.

"Anyone who has felt the need to make a complaint to us deserves a timely response. Our current response times are not where we want them to be, and we know how frustrating this is for people who are asking for our help," said a spokesperson.

"We want to thank people for their patience while we address this issue. Our frontline staff continue to work hard to respond to all complaints and we are confident that our approach will bring about the necessary improvements. Please be assured that we continue to triage cases and prioritize those that urgently need attention."

A key factor in sluggish response rates were rising workloads, according to the ICO. The data protection watchdog said it received more than 10,000 complaints in the final quarter of 2024 - 746 more than in the same period a year earlier.

To deal with the backlog, it's recruiting another 19 staff. The watchdog also revealed it’s testing automated tools aimed at simplifying or speeding up various administrative tasks, allowing case officers to spend more time on the complaint itself.

However, it warned, things are likely to get worse before they get better.

ICO woes reflected across Europe

Data protection authorities across Europe are facing a similar rise in workloads as the number of complaints skyrockets. Research from the EU Agency for Fundamental Rights last summer concluded they've been facing an ever-mounting workload since the introduction of the GDPR, with limited staff and inadequate funding. Much of this workload comes from minor complaints.

Dr Ilia Kolochenko, CEO at ImmuniWeb and a fellow at the British Computer Society (BCS), said these issues highlight the fact that some operational aspects of the legislation “were not properly designed”.

“National DPAs are frequently understaffed and underfunded, but flooded with the ballooning number of complaints," Kolochenko commented.

This, he added, means the authorities are forced to prioritize major cases and that taking minor cases to court is often just a waste of money. This then results in organizations adopting lax approaches to compliance.

"In order to ensure a consistent, invariable and equitable investigation and remediation of data protection violations, both EU states and the UK should consider allocating additional funds to their national DPAs to be commensurable with the volume and complexity of incoming complaints," he said.

"Otherwise, toothless enforcement regimes merely invite more violations of data protection law."

MORE FROM ITPRO

• NHS supplier hit with £3m fine for security failings that led to attack
• Information Commissioner John Edwards calls on firms to beef up support for data breach victims
• ICO threatens enforcement action against websites with 'harmful' cookie banners

A Birmingham-based software provider has been handed a £3 million fine for security failings that led to a ransomware attack on the NHS.

The Information Commissioner's Office (ICO) said Advanced Computer Software Group failed to use appropriate security measures before the 2022 attack, which put the personal information of tens of thousands of NHS patients at risk. 

Advanced provided the NHS with a range of patient management and health-related products, including Adastra, Caresys, Carenotes, Odyssey, Crosscare, Staffplan, and eFinancials.

But there were gaps in its use of multi-factor authentication (MFA), a lack of comprehensive vulnerability scanning, and inadequate patch management, according to the data protection watchdog.

"The security measures of Advanced’s subsidiary fell seriously short of what we would expect from an organisation processing such a large volume of sensitive information," said information commissioner John Edwards.

"While Advanced had installed multi-factor authentication across many of its systems, the lack of complete coverage meant hackers could gain access, putting thousands of people’s sensitive personal information at risk."  

The hackers, believed to be the LockBit ransomware group, accessed certain systems of Advanced’s health and care subsidiary via a customer account that lacked MFA.

Personal information belonging to 79,404 people was taken in the attack, including details of how to gain entry into the properties of 890 people who were receiving care at home.

Emergency prescription services, ambulance dispatching systems, and the non-emergency 111 phone line were affected, with some healthcare staff unable to access patient records.

"People should never have to think twice about whether their medical records are in safe hands," said Edwards.

"To use services with confidence, they must be able to trust that every organisation coming into contact with their personal information – whether that’s using it, sharing it or storing it on behalf of others – is meeting its legal obligations to protect it."

The fine forms part of a voluntary settlement. And while very large, it's less than Advanced might have been facing - the ICO warned last summer in its provisional findings that it planned to hit the company with a £6.09 million penalty.

What's changed since then is the company's proactive engagement with the National Cyber Security Centre (NCSC), the National Crime Agency (NCA) and the NHS, and the steps it's taken to mitigate the risk to those impacted by the attack. 

However, the ICO said the fine sends a salutary message to other organizations that may be a bit slapdash about the security of personal data.

"With cyber incidents increasing across all sectors, my decision today is a stark reminder that organisations risk becoming the next target without robust security measures in place," said Edwards.

"I urge all organisations to ensure that every external connection is secured with MFA today to protect the public and their personal information - there is no excuse for leaving any part of your system vulnerable." 

MORE FROM ITPRO

• More than 300,000 US healthcare patients impacted in suspected Rhysida cyber attacks
• Cyber attacks on healthcare organizations are surging
• Healthcare organizations need to shake up email security practices

A Dutch IT company has demonstrated exactly how not to handle data protection after a number of hard drives containing sensitive medical data were found for sale at a Belgian flea market.

First reported in Dutch broadcaster Omroep Brabant, 62-year-old Robert Polet from Breda found the hard drives on sale for roughly €5 each in a flea market after taking a pit stop on his way back from Belgium.

Polet, a computer-crazy camera enthusiast, said that on returning to his home in Breda and inspecting the hard drives, he was shocked to find they were full of medical data from the period between 2011 and 2019.

The hard drives contained the Dutch citizen service numbers (BSN), dates of birth, addresses, prescriptions, and other medical information linked to individuals from the Utrecht, Delft, and Houten regions.

After contacting the affected healthcare organisation, based in Utrecht, Polet said he was informed the data originated from an IT company that no longer exists.

Nortade ICT Solutions used to develop software for the healthcare sector but exactly how the hard drives ended up at a flea market in Belgium is still unclear.

Polet told Omroep Brabant that once he had made the discovery he returned to the flea market to buy the rest of the hard drives, but could not ascertain where the seller had acquired them due to a language barrier.

“Nightmare” breach as “painful as anyone can imagine”

Speaking to ITPro Rick Goud, CIO and co-founder at email security and file transfer platform Zivver, described the incident as a business’ ‘worst nightmare’, but noted he was not totally surprised by the incident.

“It’s your worst nightmare right? If the company wasn’t already bankrupt they probably would be by now… It is not a surprise, but of course as painful as anyone can imagine a data leak to be.”

Elaborating on this, Goud said he feels the fact that this data managed to leak via improperly handled hardware was indicative of a period where data protection was not front of mind for some organizations working with healthcare data.

“What is interesting about this case is that it’s quite old data. I think it fits the mindset of how healthcare data was treated ten years ago,” he explained.

“It’s certainly not an excuse but it is something I do recognize from the early days when I started in healthcare. Around 20 years ago you could still walk around with DVDs inside a hospital and ask the administrator to install it and put it on the mainframe and they would just do it.”

He said that thankfully the risk profile attached to data leaks, especially those affecting health data, has meant businesses take cybersecurity and data protection more seriously over the last 10 years.

Attitudes around safeguarding data are changing

Goud attributed this improvement to a higher risk awareness driven by legislation and standards such as ISO 27001 and the NEN 7510 which set out procedures and best practices for data protection and deprecating old storage devices.

But he warned some businesses will run into this type of security weakness on a day-to-day basis, particularly when they have handed off the problem to a third party.

“They do not ask the vendor the right questions to ensure that a) as a healthcare provider they are sure that the vendor treats the data as well as they do it themselves but also think that basically by hiring somebody else to process your data that you are not responsible anymore and of course that is not true.”

Victoria Hordern, partner and data protection specialist at global law firm Taylor Wessing, told ITPro that as well as Nortade itself the healthcare organization that contracted it could be subject to investigation.

"The health organizations that engaged Nortrade ICT Solutions would be required to carry out appropriate due diligence before appointing a third party provider and ensuring that data security to protect the data is adequate," Horden said.

"Therefore, to the extent this incident reveals a failure to do this, they could also be subject to investigation and enforcement action from the data protection authority."

Goud added that regulations like ISO 27001 and NEN 7510 have been around for some time but only became legally enforceable on healthcare organizations roughly four years ago, noting that he feels there has been a ‘mindset shift’ in data protection since then.

“So that has significantly changed practices, until then it was something that the early adopters that had the intrinsic motivation to adequately protect healthcare pursued because, of course, it's costly to go through that kind of certification process. Nowadays it is a must have,” he said.

“In 2011 to 2019 where this data is from you would see probably 2 – 3% of suppliers and healthcare organizations had that type of certification, nowadays I would say that it’s closer to 70 or 80% in the Netherlands at least.”

MORE FROM ITPRO

• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools
• Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claim
• Why government email servers are top targets for state-backed hackers

The Data Use and Access Bill is a piece of legislation introduced by the UK government to allow for a greater level of data sharing and data exchange within both public and private sector organizations.

Introduced to parliament towards the end of 2024, the government says this bill could save millions of hours for many public sector workers as well as add an estimated £10 billion to the UK economy over a period of 10 years. The bill can be divided into seven sections according to the government, with the first centered on the enablement of “smart data” use outside the finance sector.

It would regulate the provision of digital verification services, digitalize birth and death registrations, make changes to the UK’s data protection regime, and transfer the function of the Information Commissioner’s Office (ICO) to a new Information Commission.

The bill would also make further provisions about the use of or access to data in areas such as health and social care, smart meter communication services, public service delivery, and online safety.

"With laws that help us to use data securely and effectively, this Bill will help us boost the UK’s economy, free up vital time for our front-line workers, and relieve people from unnecessary admin so that they can get on with their lives," technology secretary Peter Kyle said at the time of the bill’s announcement.

Experts from the tech sector have broadly welcomed the legislation, commending its focus on improving efficiency. Alex Laurie, senior vice president at Ping Identity, said that any legislation of this kind is a positive step.

“From my perspective, anything that makes it easier for us to do business as a citizen is massively important,” Laurie tells ITPro. “If it takes time out of people's working day I think it's an important thing.”

How will the Data Use and Access Bill affect the public sector?

This legislation has the public sector at its core, with many of the bill’s benefits noted by the government relating to heightening efficiencies in the UK’s police force or the National Health Service (NHS).

Within the NHS, for example, administrative processes can be very lengthy and time consuming, having a negative impact on the organization and the customer. Laurie expressed his own understanding of this, referring to a study his firm undertook regarding disabled parking permits.

“We did an analysis a few years ago on how many agencies and individual units were involved in getting a blue badge for someone, and it was like 35 different steps, which all needed identification, verification, proof,” Laurie says.

This bill will likely hone in on a set concept of data portability, Laurie adds, which is an important step forward in speeding up these sorts of processes. Lauren Wills-Dixon, solicitor at Gordons, tells ITPro the bill will also lay out a more coherent, straightforward idea of what data can be used and for what purposes.

“The bill introduces this concept of recognized legitimate interest to give organizations certainty,” she says.

Wills-Dixon explains that it will recognize several legitimate interests including national security processing, emergency response, and safeguarding efforts.

It will also cut red tape in the public sector, according to Richard Fayers, data and analytics practice lead at Slalom, reducing the lengths that workers have to go to in recording personal data use.

How will the Data Use and Access Bill affect the private sector?

While there’s a huge opportunity in the public sector space, Fayers is keen to point out how elements of the bill – such as the smart data schemes – will likely drive innovation across the private sector landscape.

For example, he suggests the bill could introduce a greater level of openness for UK businesses and turn attention towards open standards akin to what has been seen in the finance sector with open banking. Fayers sees massive opportunities across sectors by building on this interoperability of data.

There may also be better forecasting of public demand through a pooling of company information, Fayers adds, as well as the potential for businesses to share data to offer collaborative schemes or experiences to customers. Businesses could then give customers a unified profile that works from company to company.

Bill Wright, global head of government affairs at Elastic, echoes some of these predictions for potential advantages to the private sector. The bill will allow firms in every sector to access and analyze consumer data more effectively, Wright tells ITPro.

“Simplifying the data sharing rules are going to, maybe, break down some of those silos between industries and create some opportunities for startups to compete with some of the more established players,” Wright says.

It may even increase foreign investment into the UK, Wright says finally, by showing those outside the UK that the country has a data processing environment both predictable and innovative.

What do IT leaders need to know about compliance?

As with any new piece of legislation, the data use and access bill will require some degree of reorganization from firms when it comes to ensuring compliance. That being said, Wills-Dixon predicts companies that are already compliant with GDPR don't face serious challenges to becoming compliant with the Data Use and Access Bill.

“If you're carrying out research, statistical use of data, or processing in the public interest and things like that, then it will help, but for most commercial organizations, your obligations are going to be very similar as drafted,” Wills-Dixon adds.

That said, Fayers warns the new Information Commission will have enhanced enforcement powers and businesses will also need to ensure they can demonstrate robust security and data governance. This will demand a greater focus on compliance certification and accountability frameworks, Fayers says.

“If you're seen to be transparent – if you're providing customers with assurance and visibility of how you're managing this risk as well – that could also be seen as a benefit, whilst there's a cost,” Fayers concludes.

MORE FROM ITPRO

• What is chaos engineering and how can it benefit businesses?
• What is quiet firing?
• Why magic links should be the default password replacement

The rapid growth of AI is outpacing effective governance, researchers have warned, with business leaders desperate for more clarity on regulation.

NTT Data’s Responsibility Gap Survey of C-suite executives concludes that there's an urgent need for stronger AI leadership, balancing innovation with responsibility.

Eight-in-ten said a lack of clear policies is preventing them from scaling generative AI initiatives​, and that unclear government regulations are hindering AI investment and implementation, leading to delayed adoption.

And while nine-in-ten executives said they worry about AI security risks, only a quarter of CISOs said they have a robust governance framework​.

"The enthusiasm for AI is undeniable, but our findings show that innovation without responsibility is a risk multiplier," said NTT Data CEO Abhijit Dubey.

"Organizations need leadership-driven AI governance strategies to close this gap — before progress stalls and trust erodes."

There's a big split amongst C-suite executives about the appropriate balance between safety and innovation. A third of executives believe responsibility matters more than innovation, one-third think the opposite, and one-third rates them equally.

There are also concerns about sustainability, with three-quarters of leaders saying that their AI ambitions conflict with corporate sustainability goals, forcing them to rethink energy-intensive AI solutions.

Additionally, two-thirds of executives say their employees lack the skills to work effectively with AI, while 72% admit they don't have an AI policy in place to guide responsible use.

NTT Data recommends introducing Responsible by Design Principles, building AI responsibly from the ground up and, integrating security, compliance, and transparency into development from day one.

Leaders need a systematic approach to ethical AI standards, going beyond legal requirements, and organizations should upskill employees to work alongside AI and ensure teams understand AI’s risks and opportunities.

Meanwhile, there needs to be global collaboration on AI policy, with businesses, regulators, and industry leaders coming together to create clearer, actionable AI governance frameworks and establish global AI standards.

"AI’s trajectory is clear — its impact will only grow. But without decisive leadership, we risk a future where innovation outpaces responsibility, creating security gaps, ethical blind spots, and missed opportunities," said Dubey.

"The business community must act now. By embedding responsibility into AI’s foundation—through design, governance, workforce readiness, and ethical frameworks—we unlock AI’s full potential while ensuring it serves businesses, employees, and society at large equally."

MORE FROM ITPRO

• Everything you need to know about AI and data protection
• Why your business needs data protection policies
• A lack of AI guidance is causing serious GDPR headaches

The push towards data sovereignty continues, with 51% of UK organizations now acknowledging it as a crucial aspect of their data management strategy.

According to a study of 500 IT decision makers in large organizations carried out by OVHcloud, more than three-quarters said they believe data sovereignty is now more important to their organization than it was three years ago.

However, their views on data sovereignty varied considerably. Four-in-ten said they saw it primarily as a compliance issue, while 36% saw it as a question of data access, handling or storage, and 28% as relating to data portability.

"Forty one percent of UK organizations told us that data sovereignty is simply something to be complied with," said Matt Tebay, multi-cloud evangelist at OVHcloud.

"However, forty two percent said that it was important to customers, and therefore an asset to them and their businesses. This shows a change in how companies have traditionally seen data sovereignty, and an evolution of how they’re approaching it more broadly."

Businesses are willing to pay the extra, with almost two thirds of organizations saying they were happy to pay between 11% and 30% more for a sovereign technology product that would meet all of their regulatory and sovereignty needs.

Only 6.5% said they weren't willing to pay more than normal for a sovereign product.

“Data sovereignty is gaining maturity, but it’s not an easy matter. Twenty-three per cent of IT decision makers told us that they viewed data sovereignty as ‘complex and full of drama’, and 27% said that they thought it was comparable to the hit TV show The Office – and if they didn’t laugh, they’d cry," said Tebay.

"Clearly, the intersection of customer trust, technology, regulation and commercial considerations can make for a challenging journey, but it’s an important one and like all journeys, the first step is the most important."

Data sovereignty is becoming a growing necessity, thanks to concerns over privacy and the potential for data to be accessed by other nation states.

While the EU has been in the lead in introducing regulations, other governments are moving to bring similar rules, including Egypt, Singapore, the United Arab Emirates (UAE), and the US.

According to Gartner, by 2027 data sovereignty will be one of the two top criteria, along with sustainability, when evaluating public cloud generative AI services.

"Digital sovereignty will drive the need to include cloud providers that can meet the evolving and unique requirements of sovereign operations no matter the region they operate in," said Sid Nag, vice president analyst at Gartner.

Only half of UK businesses are fully complying with all data privacy regulations and industry guidelines - an improvement, but not much of one.

Research from Zoho Digital found that the figure has risen from 2023's 42%, but that many businesses still need to improve their data practices.

On the plus side, transparency of data practices emerged as a growing strength, with 50% of respondents saying that their data privacy policies are clear, simple, and transparent, up from just 33% in 2023.

"According to Zoho’s Digital Health survey, businesses must improve transparency around data usage as a clear step toward ethical behaviour," said Sachin Agrawal, Zoho managing director.

“This will play an important role in improving customer experience, strengthening customer relationships."

The survey revealed that 47% of businesses now view data privacy as a critical part of their success, and that 46% conduct regular data privacy training for employees.

However, it also identified serious gaps where businesses are falling behind. Only three-in-ten businesses reported going beyond requirements to provide additional protection for customer and employee data.

This, Zoho noted, suggests that while businesses are meeting their compliance requirements, few are taking proactive steps to enhance data protection.

"In an increasingly data-driven world, organisations must prioritize data privacy throughout their operations. It is encouraging to see the growing recognition of data privacy’s role in driving business policies, but there is still a lot of progress to be made," said Agrawal.

"To unlock the full transformative potential of technologies like AI, businesses must have clear and well-defined data strategies which both protect customer and employee data but enable flexibility of use in the right way."

The report comes hot on the heels of research from ISACA, which found only a third of data privacy professionals are confident in their organization’s ability to safeguard sensitive data, and just a quarter follow Privacy by Design best practices.

Their teams underfunded, they said, and more than half told ISACA they expect budgets to decline this year.

ISACA warned that many organizations risk falling foul of GDPR and new legal frameworks such as the Digital Services Act and EU AI Act.

Recently, Charlie Bromley-Griffiths, senior legal counsel at legal document management software form Conga, told ITPro that UK businesses had made substantial strides in aligning with privacy legislation.

"Companies have implemented stronger data governance policies, enhanced security protocols and prioritized the rights of data subjects," she said. "However, challenges still remain, particularly for small and medium-sized enterprises struggling with the complexity and cost of full compliance."

The number of GDPR fines issued last year fell by a third compared with 2023 , according to new research, but this doesn't mean data protection authorities are getting any softer.

DLA Piper's GDPR Fines and Data Breach Survey found that €1.2 billion in penalties was issued during the year, down 33%. This marks the first time the amount has fallen since the GDPR was introduced in May 2018.

Thanks to the many tech firms headquartered in the country, Ireland remains the biggest enforcer, with the Irish Data Protection Commission issuing €3.5 billion in fines since May 2018.

That's more than four-times the value of fines issued by the second-placed Luxembourg Data Protection Authority, which has issued €746.38 million over that time. Total fines reported since the start of GDPR in 2018 now stand at €5.88 billion.

But DLA Piper said last year's big drop doesn't represent a weakening of enforcement; the year-on-year trend remains upwards.

It's actually due to a skewing of the 2023 figures by the record-breaking €1.2 billion penalty issued by the Irish DPC against Meta in 2023, which remains the largest ever imposed.

"The headline figures in this year's survey have, for the first time ever, not broken any records so you may be forgiven for assuming a cooling of interest and enforcement by Europe's data regulators. This couldn't be further from the truth," said Ross McKean, partner and chair of DLA Piper's UK data protection and cyber practice.

"From growing enforcement in sectors away from big tech and social media, to the use of the GDPR as an incumbent guardrail for AI enforcement as AI specific regulation falls into place, to significant fines across the likes of Germany, Italy and the Netherlands, and the UK's shift away from fine-first enforcement – GDPR enforcement remains a dynamic and evolving arena."

It's still the big tech companies and social media giants that are getting the biggest fines, with nearly all of the top ten largest fines since 2018 imposed on firms operations in this sector.

Across 2024, the Irish Data Protection Commission issued fines of €310 million against LinkedIn and €251 million (£208m) against Meta. In August 2024, the Dutch Data Protection Authority issued a fine of €290 million against a well-known ride-hailing app.

The UK was an outlier in 2024, issuing very few fines. Information Commissioner John Edwards previously noted that he wasn’t in favor of issuing fines.

Edwards said these were unlikely to have significant impact and would tie the ICO up in years of litigation.

GDPR fines mirrored by personal liability risks

Perhaps most significantly, there's been an increased focus on failures in governance and oversight, with some specifically calling out failings of management bodies.

Most notably, the Dutch Data Protection Commission announced an investigation into whether it can hold the directors of Clearview AI personally liable for numerous GDPR breaches, following a €30.5 million fine against the company.

DLA Piper said this potentially signals a shift in focus by regulators, who recognize the power of personal liability to focus minds and drive better compliance.

"For me, I will mostly remember 2024 as the year that GDPR enforcement got personal," said McKean.

"As the Dutch DPA champions personal liability for the management of Clearview AI, 2025 may well be the year that regulators pivot more to naming and shaming and personal liability to drive data compliance."

It's been four years since the UK General Data Protection Regulation (GDPR) came into force after the UK left the European Union (EU).

However, while the UK legislation remains aligned with that of the EU, it gives the UK the independence to keep the framework under review.

Like the EU GDPR, the UK version places requirements on organizations that process personal data, based on seven principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality and accountability.

Charlie Bromley-Griffiths, senior legal counsel at legal document management software form Conga, said that while the legislation has delivered marked benefits, lingering issues remain.

"Over the last four years, UK businesses have made substantial strides in aligning with UK GDPR requirements. Companies have implemented stronger data governance policies, enhanced security protocols and prioritized the rights of data subjects," Bromley-Griffiths said.

"However, challenges still remain, particularly for small and medium-sized enterprises struggling with the complexity and cost of full compliance. GDPR mandates stringent measures to safeguard consumer data, which includes data storage, processing and transfer practices, all of which impacts organizations’ data strategies and operational costs."

Brexit has also caused issues with regard to the transfer of personal data between the UK and the European Economic Area (EEA), along with UK controllers who have an establishment or customers in the EEA, or who monitor individuals in the area.

While the EU GDPR still applies to this processing, the way organizations interact with European data protection authorities has changed.

"The international data landscape is now rather complex. UK businesses handling data from the European Union (EU) must also comply with the EU GDPR," said Bromley-Griffiths.

"Then, of course, there is the US-UK data bridge, which forms part of the EU-US Data Privacy Framework and permits the flow of EU-based data to the United States under certain conditions."

All this, she said, highlights the importance of maintaining two or more compliance strategies to make sure operations across borders go smoothly – and, ultimately, keep the trust of customers, reassuring them that their data is safe.

Looking ahead, Bromley-Griffiths expects regulatory bodies to look at cracking down harder on repeat offenders or businesses that have suffered significant data breaches.

Meanwhile, the UK GDPR is likely to be amended, with the introduction last October of the Data Use and Access Bill in the House of Lords. With this bill, and in future, the UK is unlikely to diverge significantly from EU legislation.

It currently enjoys 'data adequacy' with the EU, meaning that personal data can be transferred freely between the two. If this were lost, it could be an economic disaster.

However, more minor changes, said Bromley-Griffiths, could be on the cards.

"Given how quickly cyber threats are evolving, the UK GDPR standards may be updated. Businesses need to have the appropriate tools and measures in place to ensure that they are ready to adapt to any legislative changes," she said.

"Organizations must remain committed to investing in their employee’s ongoing education but also in the right technology to safeguard personal data."

UK bank NatWest has blocked staff from using a range of unapproved messaging apps in a bid shake up internal communications practices.

According to reports from the BBC, NatWest has removed access to consumer messaging platforms such as WhatsApp, Facebook Messenger, and Skype on work devices, telling staff to stick to approved channels instead.

"Like many organizations, we only permit the use of approved channels for communicating about business matters, whether internally or externally," a NatWest statement said.

Approved channels keep a record of communications where other messaging applications may not store messages. Several big-name banks in the US, such as JPMorgan Chase and Wells Fargo, have received regulatory flack over staff using poorly recorded comms channels.

While this practice is particularly important in financial services or other industries where high-risk data is processed, using proper communication channels is crucial for any enterprise, Element CEO Matthew Hodgson told ITPro.

“An organization’s choice of communication tool is not merely a technical decision but a governance imperative, which is of particular importance to financial sector organizations like NatWest, given the sensitive nature of the data they handle everyday,” Hodgson said.

“Anything less risks not just operational inefficiency, but the very foundations of accountability,” Hodgson added.

Despite this, restrictions of this kind have reported limited success. A 2023 report from Global Relay found that while 59% of respondents had committed to bans on WhatsApp and similar applications, only 2.6% considered the move an effective solution that would withstand regulatory scrutiny.

Good comms is good business

Selecting specific communication tools for business use can help in a variety of ways, according to Robert Cruz, VP of information governance at Smarsh. For example, it can make the governance process of evaluating new communications tools evergreen.

“New tools will emerge, and clients will continue to ask to engage on tools that are not currently supported. Having a process in place allows you to be agile and responsive to the business while ensuring that your controls are effective,” Cruz told ITPro.

Cruz gave the example of a business wanting to conduct communications on Telegram, which would only be possible if the business had determined it could manage the technology and potential compliance risks.

Having approved comms guidelines also allows staff from different departments to input into comms decision-making, Cruz said. Employees may have preferences for new tools, he added, and stakeholders from across the businesses can help decide whether the benefits exceed the risk if comms management is in place.

Comms management is a boon for IT 

Concerning the IT department specifically, clear-cut comms policies can enable more efficient and more effective responses to certain problems in the business, Cruz said.

Such problems include regulatory inquiry, litigation, or internal investigations, which can be dealt with as and when they arise. The alternative here could become time-consuming and an inexact process that requires collecting content from a range of unmanaged sources and devices.

It also allows IT teams to manage data protection guardrails across communication channels in a comprehensive manner, Cruz said, which can aid in matters of security and ensuring compliance.

“The due diligence that goes into determining which tools can be approved for use (typically, via IT partnership with compliance) can eliminate surprising vendor practices later,” Cruz added.

The UK Information Commissioner’s Office (ICO) is calling on organizations to do more to support victims after a data breach.

According to ICO figures, nearly 30 million people in the UK have experienced a data breach. In total, 55% of UK adults reported having had their data lost or stolen, with 30% of them experiencing emotional distress as a result.

However, a quarter said they received no support from the organizations responsible and 32% found out about the breach via the media, rather than from the organization itself.

Information Commissioner John Edwards said the figures highlight that many organizations “fail to fully appreciate the harm they cause then they mishandle personal data”.

Edwards urged enterprises to act with “empathy and action” when dealing with data breach victims.

"Today, I want to issue a stark warning to organizations across the country: you must do better," he said.

"When a data breach occurs, it’s not just an admin error – it is a failure to protect someone. In many cases if that someone is in a vulnerable situation, they are already facing innumerable personal challenges, or they may be at risk of harm."

Qualitative research conducted by the ICO, meanwhile, found people have had to move homes, felt forced out of their jobs, and faced discrimination as a result of data breaches. Analysis from the data protection watchdog found the real impact on their life was insufficiently recognized by the organization responsible.

ICO issues updated guidance for organizations

New guidance issued by the ICO calls on organizations to assess the risks to the individuals involved, and carry out its reporting and notification duties promptly.

They should acknowledge what has happened to people affected by a breach, be human and accessible in their response, and commit to making sure it doesn’t happen again.

Similarly, organizations should share ICO guidance with people affected by a breach, and make sure that staff have access to the ICO toolkit of resources.

Another key focus should be implementing changes to corporate culture and ensuring that empathy is at the heart of their response, the ICO said.

"To many organizations, a data breach might seem like a temporary setback - something that can be patched up with technical fixes and compliance reviews," said Edwards.

"But from the perspective of individuals - especially those in vulnerable situations - a breach can have a far-reaching ripple effect that disrupts their lives in ways that some may not fully appreciate."

Ireland's Data Protection Commission (DPC) has hit LinkedIn with a €310 million fine after ruling it misused personal data for behavioral analysis and targeted advertising.

The ruling follows a complaint submitted to the French data protection authority in 2018 by privacy non-profit La Quadrature Du Net, and later referred to the DPC as the lead supervisory authority for LinkedIn.

The personal data involved both first-party data from members themselves and data obtained via LinkedIn's third-party partners.

Processing this sort of data requires one of a few legal justifications, such as consent, contractual necessity, or legitimate interests, but certain conditions must apply, such as informed consent, fairness, and transparency.

According to the DPC, LinkedIn failed to satisfy these conditions.

In terms of consent, the regulator said this wasn't freely given, sufficiently informed, or specific or unambiguous.

Meanwhile, LinkedIn couldn't rely on the legitimate interests argument, according to the DPC as the fundamental rights and freedoms of users should trump those of LinkedIn itself; and nor did contractual necessity apply.

"The lawfulness of processing is a fundamental aspect of data protection law and the processing of personal data without an appropriate legal basis is a clear and serious violation of a data subject's fundamental right to data protection," said DPC deputy commissioner Graham Doyle.

The decision also sees LinkedIn reprimanded and ordered to bring its practices into line with the GDPR. LinkedIn has accepted the findings.

"Today the Irish Data Protection Commission (IDPC) reached a final decision on claims from 2018 about some of our digital advertising efforts in the EU," it said in a statement.

"While we believe we have been in compliance with the General Data Protection Regulation (GDPR), we are working to ensure our ad practices meet this decision by the IDPC's deadline."

While dwarfed by the €1.55 billion penalty imposed against Meta last year, the LinkedIn fine is one of the largest ever imposed against a tech firm by the DPC for GDPR breaches.

Javvad Malik, lead cybersecurity awareness advocate at KnowBe4, said it's good to see regulators actively enforcing and standing up for user rights. Malik added that the incident highlights the importance of building robust data governance frameworks.

"It does serve as a reminder that relying on 'legitimate interests' as a legal basis is a risky strategy and can lead to significant penalties and reputational damage," he said.

“Ultimately, this ruling showcases how vital it is for organisations to reassess their business models and the ethics around targeted advertising. Rather they need to shift towards more user-centric models where users are clearly informed and given the ability to make decisions that are best for them."

Zero trust security specialist, Rubrik, and Pure Storage have announced a new partnership to help organizations navigate the challenges of exponential data growth in the modern security landscape.

The collaboration combines key elements of Rubrik's Security Cloud and the Pure Storage Platform to create a three-layered reference architecture capable of ensuring uptime and defense against the growing number of cyber threats.

Announcing the partnership, the CEO of Pure Storage, Charles Giancarlo, said enterprises now require multi layered architecture to outpace and counteract bad actors.

"The combination of Pure Storage and Rubrik delivers a solution designed to strengthen defenses while continuously evolving and scaling," he said. "Together, we're committed to providing businesses with a robust, adaptive framework that drives true cyber resilience, helping them stay ahead in a complex cyber security landscape."

Triple-layered defense

The two companies said the collaboration had conjured up a new, three-layered strategy that covers rapid defense, data security, and archival location.

With the first layer, customers will have access to a feature on the Pure Storage Platform that allows them to use 'immutable snapshots' for rapid recovery and near-zero recovery time objectives during a cyber attack. The snapshots are stored in a secure enclave which is only accessible to designated contacts that have been authenticated via Pure Storage Support.

The second layer works to protect data stored on the Pure Storage FlashArray, with Rubrik's Security Cloud providing immutable and on-site backup through the Rubrik Secure Vault. This works alongside additional capabilities such as anomaly detection, threat monitoring, threat hunting, sensitive data monitoring, user intelligence, and orchestrated recovery.

The third and final layer focuses on archival storage to aid with data recovery, with Pure Storage's FlashBlade//S and FlashBlade//E solutions offering flexible and cost-effective options depending on the customer's needs.

Critical priority

Data growth is outpacing the ability to secure it and mitigate its risk, according to 66% of IT security leaders in Rubrik Zero Labs latest report. In response, Rubrik's co-founder and CEO, Bipul Sinha, said the company's new partnership with Pure Storage represents an opportunity for customers to bolster their cyber resilience.

"As more and more organizations realize that cyber resilience is the most essential cyber security strategy, Pure Storage and Rubrik have come together to deliver the most complete cyber resilient hyper cloud solution," he explained.

"Having spent time with Charlie discussing cyber resilience, it became evident that our two companies had a tremendous opportunity to help our customers with data security and business continuity."

LinkedIn has suspended the use of UK user data for AI training following a fierce backlash from digital rights campaigners, users, and regulators.

The social network recently changed its privacy policy to use an ‘opt-out’ setting for the use of customer data to train its internal AI models.

In an update to its policies, the Microsoft-owned firm said the use of user data would help improve generative AI features. The change prompted a backlash among users on social media, with digital rights campaigners urging users to opt-out of the scheme.

"Like other features on LinkedIn, when you engage with generative AI powered features we process your interactions with the feature, which may include personal data (e.g., your inputs and resulting outputs, your usage information, your language preference, and any feedback you provide)," LinkedIn said in its FAQs.

The UK’s Information Commissioner’s Office (ICO) expressed concerns over the move, with the regulator noting that the opt-out approach wasn’t sufficient to protect user privacy.

Similarly, digital rights group Open Rights Group complained the opt-out model “proves once again to be wholly inadequate to protect our rights”.

“The public cannot be expected to monitor and chase every single online company that decides to use our data to train AI," said legal and policy officer Mariano delli Santi.

"Opt-in consent isn't only legally mandated, but a common-sense requirement."

LinkedIn U-turn welcomed by privacy watchdog

LinkedIn has since backed down, however, and will no longer apply the policy in the UK, along with the EU, the European Economic Area, and Switzerland.

In a statement, Blake Lawit, SVP and general counsel at LinkedIn, said the company has changed its user agreement to include more details on its content recommendation and content moderation practices, along with new provisions relating to generative AI.

The privacy policy, meanwhile, now has more information on how user data is harnessed to develop products and services. This includes details on how user data is used to train AI models.

"We are not enabling training for generative AI on member data from the European Economic Area, Switzerland, and the United Kingdom, and will not provide the setting to members in those regions until further notice,” Lawit added.

The ICO has welcomed the decision, noting in a statement that LinkedIn has taken on board key concerns raised about its approach to AI training.

"We are pleased that LinkedIn has reflected on the concerns we raised about its approach to training generative AI models with information relating to its UK users,” said Stephen Almond, ICO executive director, regulatory risk.

"In order to get the most out of generative AI and the opportunities it brings, it is crucial that the public can trust that their privacy rights will be respected from the outset."

The use of user data for training AIs has become a controversial one. Earlier this year, Meta halted the use of the data of UK Facebook and Instagram data for this after the ICO raised concerns.

The company has since started using UK data once again under an altered consent model, claiming it satisfied the ICO's demands.

The ICO said it will continue to monitor the situation with Meta - and the same, Almond said, will be true of LinkedIn.

“We will continue to monitor major developers of generative AI, including Microsoft and LinkedIn, to review the safeguards they have put in place and ensure the information rights of UK users are protected," he said.

Meta will continue using Facebook and Instagram posts from UK users to train its AI, potentially setting it up for further conflict with the Information Commissioner's Office (ICO).

Earlier this summer, the company said it was delaying plans to use EU and UK user data to train its Meta AI software. However, it's now announced plans to go ahead, stating it was for the "benefit of its users".

"This means that our generative AI models will reflect British culture, history, and idiom, and that UK companies and institutions will be able to utilise the latest technology," the company said in a statement.

Meta has said it won't use people's private messages, nor information from accounts belonging to under-18s.

"We'll use public information – such as public posts and comments, or public photos and captions – from accounts of adult users on Instagram and Facebook to improve generative AI models for our AI at Meta features and experiences, including for people in the UK," it said.

From this week, users will start getting in-app notifications, through which they can opt out of the system; this, it says, satisfies a demand from the ICO. Unfortunately for Meta, though, the ICO isn't quite so certain that all is now well.

"In June, Meta paused its plans to use Facebook and Instagram user data to train generative AI in response to a request from the ICO. It has since made changes to its approach, including making it simpler for users to object to the processing and providing them with a longer window to do so," said Stephen Almond, executive director, regulatory risk, at the ICO.

"Meta has now taken the decision to resume its plans and we will monitor the situation as Meta moves to inform UK users and commence processing in the coming weeks."

And, he adds, "The ICO has not provided regulatory approval for the processing and it is for Meta to ensure and demonstrate ongoing compliance."

Meta has been using user data from other jurisdictions, including the US, for some time. It hasn't said whether it now plans to start using user data from the EU, but the Irish Data Protection Commission (DPC) – which regulates Meta in the EU – has already objected to the idea. Several national data protection authorities across the region have also voiced their disquiet.

Meanwhile, privacy rights non-profit campaign group Noyb has filed several complaints in individual EU nations, alleging that the company is in breach of the General Data Protection Regulation (GDPR).

The move does, though, have the seal of approval from tech trade association the Computer & Communications Industry Association (CCIA).

"It is very encouraging to see more cutting-edge AI development able to take place in the UK. This shows that genuine collaboration between industry and regulators can foster a framework where privacy protections and an environment conducive to investment and innovation work seamlessly together," said senior director and head of CCIA's London office Matthew Sinclair.

"Today is a positive sign for the government's ambitions for the UK's role in the global digital economy."

Uber has been fined €290 million by the Dutch data protection authority for transferring the personal data of European drivers to the US without appropriate safeguards.

According to the Dutch DPA, the transfers - which Uber has now halted - were a serious violation of the EU's General Data Protection Regulation (GDPR).

"In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due careBut sadly, this is not self-evident outside Europe,” said Dutch DPA chairman Aleid Wolfsen.

"Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union. Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious."

The investigation was prompted by complaints from more than 170 French drivers to the French human rights interest group the Ligue des droits de l’Homme (LDH), which subsequently submitted a complaint to the French DPA. 

However, Uber's European headquarters is based in the Netherlands, making it the official supervisory authority.

The Dutch DPA found Uber collected sensitive information of drivers from Europe and retained it on servers in the US. The data included account details and taxi licenses, as well as location data, photos, payment details, identity documents, and in some cases even the criminal and medical data of drivers.

The transfers continued for more than two years.

There are, or have been, various ways to make US data transfers without breaching the GDPR. However, the European Court of Justice invalidated the EU-US Privacy Shield in 2020, and Uber stopped using the alternative of Standard Contractual Clauses in August 2021. It has since switched to using the successor to the Privacy Shield.

The Computer & Communications Industry Association (CCIA Europe) said Uber was put in a difficult situation by the EU's decision to invalidate Privacy Shield back in 2020. This move, it said, left European and American companies without any clear guidelines for transatlantic data flows for a period of nearly three years.

Meanwhile, the Commission ruled out the use of Standard Contractual Clauses for non-EU companies already subject to European data protection rules, leaving companies without any straightforward mechanism to move EU data to servers in the US.

"The fact that the Dutch Data Protection Authority today decided to issue a massive fine to a tech company for EU-US data flows that happened back in 2021 ignores reality. The busiest internet route in the world could not simply be put on hold for three entire years while governments worked to establish a new legal framework for these data flows," said CCIA Europe’s head of policy, Alexandre Roure.

"Any retroactive fines by data protection authorities are especially worrisome given that these very privacy watchdogs failed to provide helpful guidance during this period of significant legal uncertainty, in absence of any clear legal framework."

This is the third fine imposed on Uber by the Dutch DPA, which hit the company with a €600,000 penalty in 2018 and another for €10 million in 2023. Uber has objected to this latest fine.

Businesses are increasingly taking advantage of generative AI to boost efficiency – but the technology also poses significant data protection risks. AI relies on masses of data to operate and using it at scale can lead to unintentional sharing of private business information.

One in five UK companies has had potentially sensitive corporate data exposed via employee use of generative AI, a new report [PDF] by RiverSafe has revealed. Take the example of tech giant Samsung, which was forced to ban the use of generative AI after staff shared sensitive data including source code and meeting notes with ChatGPT as reported by Techradar Pro.

The risks span multiple vectors – exposed information is in breach of data protection policies such as the General Data Protection Regulation (GDPR) or Data Protection Act (DPA) 2018.

Last year, Forrester senior analyst Alla Valente described how generative AI use will lead to major data breaches and fines for application developers using the technology.

So, what exactly are the data protection risks posed by generative tools such as ChatGPT and how can companies put a strategy in place to mitigate these?

AI and data protection risks

One of the key concerns centers around the handling of sensitive information by AI systems, says Chris Harris, EMEA technical associate vice president for data security at Thales. “Given the vast amounts of data these systems are ingesting and processing, there’s a real risk that sensitive information is also being captured and could be inadvertently revealed.”

Adding to the complexity, the integrity of AI systems heavily depends on the quality and reliability of the data they’re trained on. If malicious information is introduced into training datasets – what’s known as “data poisoning” – the learning process can be corrupted and compromise the model’s performance, Harris says. “Outputs could also be biased or factually incorrect, with the potential to manipulate outcomes and undermine decision-making processes if sufficient scrutiny isn’t in place.”

Meanwhile, cybercriminals could trick generative AI systems into extracting and sharing confidential data, such as customer records, financial transactions, or trade secrets. “These breaches put privacy at risk and expose enterprises to penalties, legal trouble, and damage to their reputation,” says Harris.

AI and data protection legislation

Using generative AI tools in business poses distinct regulatory challenges. While there isn't any regulation that specifically covers generative AI, current legislation and guidance create standards for responsible use of the technology, says Dr Leanne Allen, partner, data, data science and AI lead, KPMG UK.

For example, the EU AI Act, the OECD's AI principles, and the Digital Services Act stipulate that any type of AI must be “robust, safe, trustworthy, and secure”, she says.

Regulation around personal data is especially important for firms using AI, says Ben Travers, AI expert and partner at law firm Knights. “Many businesses will not have obtained appropriate consent, or don’t have another valid legal basis for processing personal data through AI. Any organization that defaults to legitimate interest as the basis for uploading personal data to an AI has probably misunderstood how the law works in this area.”

Ensuring generative AI adheres to data protection regulations such as the GDPR is “complex”, says Philip Brining, co-founder and managing director of Data Protection People. The technology's need for vast amounts of data often conflicts with GDPR principles such as data minimization and purpose limitation, he says.

Data subject rights under regulations – including the right to access, rectify, and erase data – add another layer of complexity, says Brining. “Ensuring generative AI systems comply with these rights is challenging, especially when data is deeply integrated into AI models.”

At the same time, GDPR requires all personal data to be stored either in the EU or within a jurisdiction that has comparable levels of protection. Sending personal data to a non-compliant data center outside of the EU will therefore break GDPR law. Amidst all this, UK businesses are still struggling to ensure their staff comply with GDPR rules when using AI.

Transparency and accountability are other factors to be taken into account. For example, it’s important to consider that firms may be required to explain a generative AI model's decision-making process, says Kevin Curran, IEEE senior member and professor of cyber security at Ulster University. This is especially true in “high-stakes” situations such as loan approvals or medical diagnoses, he says.

AI and data protection strategies

Data protection will continue to be a key concern for any firm including generative AI in their operations. But as AI technology develops, it’s possible to manage this using strategies and tools.

One of the key principles to adhere to is “privacy-by-design”, says Harris. “This means privacy protections should be a default consideration, ensuring that data collection aligns with reasonable expectations.”

Data anonymization and pseudonymization are essential techniques to protect identifiable information before feeding it into generative AI models, says Brining. “Implementing robust access controls is vital. Limiting who can interact with generative AI systems and what data can be processed helps prevent unauthorized access and data breaches.”

Developing AI-specific policies and procedures and regularly updating them ensures that data input standards, model training processes, and output handling are “well-defined and compliant with regulations”, Brining adds.

It may be that this is overseen by the CIO at a business, but some firms have also recognized the unique complexity of AI onboarding by hiring chief AI officers (CAIOs).

Meanwhile, businesses should consider whether it would be more appropriate to direct employees into using enterprise versions of generative AI tools to control use and access, says Jon Bartley, partner and head of the data advisory group at law firm RPC. “This may be a more practical solution compared to simply restricting employees from using free online tools.”

For example, when it comes to using AI to generate code there are a number of enterprise options including GitHub Copilot, Gemini CodeAssist, or Code Llama which can demonstrably deliver returns for business without putting proprietary code at risk.

It’s also important to bear in mind that any implementation of AI models within an organization is never truly finished. Ongoing work is needed to review the decisions being made and minimize harmful outputs and toxicity, says Harris. “Wherever possible, organizations must strive for explainability in the decisions a generative AI model is making, allowing genuine human control and mitigating risks as much as possible.”

The UK Information Commissioner’s Office (ICO) has reprimanded the Electoral Commission for basic security failings that exposed personal data belonging to 40 million voters.

Two years ago, hackers successfully accessed the Electoral Commission’s Microsoft Exchange Server by impersonating a user account and exploiting known software vulnerabilities in the system.

For more than a year, they had access to the personal information held on the Electoral Register, including names and home addresses - and the servers were accessed on several occasions without the Electoral Commission’s knowledge.

The attack was widely attributed to Chinese state-sponsored attackers.

Following an investigation into the matter, the ICO found the Electoral Commission didn't have appropriate security measures in place to protect the personal information it was holding.

In particular, the watchdog said it failed to keep servers up to date with the latest security updates. The security patches for the vulnerabilities exploited in the cyber attack were released in April and May 2021, months before the attack.

Meanwhile, the Electoral Commission also had inadequate password policies in place, according to the ICO, with many accounts still using passwords identical or similar to the ones originally allocated by the service desk.

"If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened. By not installing the latest security updates promptly, its systems were left exposed and vulnerable to hackers," said Stephen Bonner, deputy commissioner at the ICO.

"I know the headline figures of 40 million people affected caused considerable public alarm when news of this breach emerged last year. I want to reassure the public that while an unacceptably high number of people were impacted, we have no reason to believe any personal data was misused and we have found no evidence that any direct harm has been caused by this breach."

The Electoral Commission has since taken steps to improve its security, including implementing a plan to modernize its infrastructure, as well as password policy controls and multi-factor authentication for all users.

But BCS fellow Dan Card said the breach shouldn't come as a surprise.

"This scenario isn't even an edge case — it reflects the state of a significant number of organizations, including some critical national infrastructure," he said.

"Reports indicate that the threat actors exploited ProxyShell, a vulnerability that was extensively discussed and addressed within the cybersecurity community. The organization's failure to act promptly is a glaring oversight, compounding the severity of the other findings."

IT decision-makers are increasingly tasked with achieving more despite constrained and, often, dwindling resources. Their roles demand simplicity in processes while ensuring the continuous security of their most valuable asset - data.

Traditionally, cybersecurity and data protection were prioritized above all else, often at the expense of added complexity and resource strain.

IT teams now face a perfect storm of challenges. The threat landscape is expanding, with ransomware attacks becoming more frequent and sophisticated. Simultaneously, they must optimize budgets, improve efficiency, and simplify technology infrastructure. While this may seem all well and good in theory, in reality, it’s a lot to ask. 

This balancing act often forces compromises in data protection strategies. Many organizations struggle to implement comprehensive backup solutions due to budget constraints, limited resources,, or overly complex systems. Consequently, critical vulnerabilities remain, exposing enterprises to potentially devastating data loss or breaches.

"After collaborating with clients of different sizes and industries, we found that organizations are indeed limited by many real-world factors in the process of protecting data, making it difficult to cover all operational aspects comprehensively," said Liu Jiayu, deputy general manager of Synology's Backup Products. 

"This means that organizations may still be exposed to cybersecurity risks, which is an area that Synology has long been focusing on and eager to provide strong assistance."

Simplifying robust data protection for modern enterprises

Understanding these challenges is crucial for developing effective data protection strategies. IT teams need solutions that address the immediate threats and also streamline the overall data protection process, making it easier to manage and maintain. Solutions must be robust, yet simple enough to deploy and operate without requiring extensive resources or specialized expertise.

Understanding the multifaceted needs of modern enterprises, Synology has developed ActiveProtect to address the most pressing data protection challenges efficiently and effectively. 

By integrating advanced technologies and user-friendly management interfaces, ActiveProtect ensures data protection without the typical complexities or high costs associated with traditional solutions. It sports several key features that translate into significant operational advantages for IT professionals, enabling them to safeguard their data while optimizing performance and reducing overheads.

ActiveProtect offers many benefits:

• All-in-one solution: ActiveProtect integrates hardware and software into a single, pre-configured package. This ensures optimal performance and reliability, saving IT personnel the effort and uncertainty of assembling various components from different vendors.
• Rapid deployment: Setting up and completing a full data backup can be done in as little as 15 minutes with ActiveProtect. This deployment significantly reduces the time and effort needed, allowing IT teams to focus on other critical tasks.
• Centralized management: ActiveProtect offers a single interface for monitoring and managing the entire backup architecture. This centralization simplifies data protection, enabling IT personnel to manage backup policies, monitor local and offsite data, and perform restorations from a unified platform.
• Advanced deduplication: Multi-level deduplication mechanisms save storage space and reduce transmission traffic. By comparing data at the source and performing global deduplication across platforms, ActiveProtect optimizes storage costs and enhances efficiency.
• Scalability and efficiency: Features such as data tiering and encrypted replication make ActiveProtect a scalable and cost-effective solution. Enterprises can define data tiering rules, moving older data to more economical storage solutions without compromising accessibility.

Simplicity, confidence, and cost reduction

Traditional solutions often require extensive configuration and ongoing maintenance, which can be resource-intensive. Synology streamlines this process through its pre-configured nature and centralized management interface. IT teams can monitor and manage backups effortlessly, ensuring that all critical data is consistently protected.

These solutions allow IT personnel to deploy a complete data protection architecture in minimal time. By eliminating cumbersome deployment steps, ActiveProtect ensures that data backup is completed quickly and efficiently. This rapid deployment is crucial in today's fast-paced business environment, where downtime can have significant repercussions.

The rapid growth of data and increased audit requirements necessitate long-term data retention, often leading to escalating storage costs. Synology addresses this issue through advanced deduplication and data tiering technologies. 

Transmitting only changes or different files during backups and performing global deduplication can significantly reduce storage space usage and transmission bandwidth.

Moreover, enterprises can set data tiering rules to move older data to more cost-effective storage solutions. This approach can reduce costs as well as  ensuring that data can be retrieved when needed from a single management interface. Combining these technologies enables ActiveProtect to help organisations build a cost-effective and scalable data protection architecture.

Delivering what IT professionals deserve

Synology’s solutions are next-generation data protection tools that place the customer at the center. They offer streamlined management and outstanding performance, addressing the challenges of 

As cybersecurity threats become more severe, these solutions give enterprises the confidence to tackle various risks and significantly enhance their operational resilience.

By adopting ActiveProtect, enterprises can achieve robust data protection without the usual trade-offs. Synology's innovative approach ensures that data security is no longer a drag or drain, allowing IT decision-makers to focus on confidently driving forward their organizations.

Learn more about the new data protection experience from Synology here.

Meta has confirmed it will pause plans to train AI systems using data from EU citizens and won't launch Meta AI in the region for the time being.

Outside the EU and UK, the company will continue with its plans to train its AI on users' Facebook and Instagram posts. The tech giant’s justification for using social media data for AI training is that this is content that users have chosen to make public.

"We are following the example set by others, including Google and OpenAI, both of which have already used data from Europeans to train AI," the company said.

"Our approach is more transparent and offers easier controls than many of our industry counterparts already training their models on similar publicly available information."

The company claimed that under the UK’s Data Protection Act and the EU’s GDPR, it had the legal right to collect data on the legal basis of ‘legitimate interests’.

"Specifically, we have legitimate interests in processing data to build these services and this means that people can object using a form found in our Privacy Centre if they wish," it said.

However, data protection authorities aren't happy. The Irish Data Protection Commission (DPC), which regulates Meta in the EU, expressed concerns, along with several national data protection authorities across the region.

Meanwhile, privacy campaign group Noyb filed complaints in 11 European countries, asking their respective data protection authorities to prevent the move before it comes into force at the end of the month.

Now, Meta has bowed to the pressure and announced that it will pause its plans in the UK and EU.

"We’re disappointed by the request from the Irish Data Protection Commission (DPC), our lead regulator, on behalf of the European DPAs, to delay training our large language models (LLMs) using public content shared by adults on Facebook and Instagram — particularly since we incorporated regulatory feedback and the European DPAs have been informed since March," the company said in a statement.

Meta insisted that the pushback is a “step backwards for European innovation” and “further delays” bringing the benefits of AI to people across Europe.

Despite the move, Meta said it's still confident its approach complies with European laws and regulations. In addition, the tech giant said that without including local information it would only be able to offer people a 'second-rate experience' - leading it to suspend the launch of Meta AI in the UK and EU.

While the move might be seen as an attempt to call the EU's bluff, it's been welcomed by the DPC, which said it will continue to engage with Meta on the issue.

The UK’s Information Commissioner’s Office (ICO) also welcomed the decision to delay the AI training plans.

"In order to get the most out of generative AI and the opportunities it brings, it is crucial that the public can trust that their privacy rights will be respected from the outset," says Stephen Almond, the ICO's executive director for regulatory risk.

“We will continue to monitor major developers of generative AI, including Meta, to review the safeguards they have put in place and ensure the information rights of UK users are protected.”

The Office of the Australian Information Commissioner (OAIC) has hit Medibank with civil penalty proceedings in federal court, seeking to hold the firm to account for an alleged mishandling of public data. 

The OAIC referred specifically to the data breach at the firm in 2022 and claimed that, from March 2021 to October 2022, Medibank “seriously interfered” with the privacy of nearly 10 million (9.7 million) Australians.

Medibank stands accused of failing to take reasonable steps to protect the personal data of its customers from “misuse and unauthorized access or disclosure,” putting it in breach of the country's privacy legislation.

“The release of personal information on the dark web exposed a large number of Australians to the likelihood of serious harm, including potential emotional distress and the material risk of identity theft, extortion, and financial crime,” said acting Australian Information Commissioner, Elizabeth Tydd.

Tydd went on to reiterate that, given Medibank’s size and resources, as well as the nature and volume of the data in question, the firm did not pursue a “reasonable” course of action in protecting customers.

“We consider Medibank’s conduct resulted in a serious interference with the privacy of a very large number of individuals,” she added.

Australian privacy commissioner Carly Kind made similar comments as part of the OAIC’s announcement, drawing attention to the responsibility that organizations have in protecting personal data.

“Organizations that collect, use, and store personal information have a considerable responsibility to ensure that data is held safely and securely. That is particularly the case when it comes to sensitive data,” Kind said.

She said that this particular case against Medicare should serve as a “wake up call” to Australian organizations, prompting companies to invest more heavily in cyber security and ensure that they are prepared to meet developing challenges.

“Organizations have an ethical as well as legal duty to protect the personal information they are entrusted with and a responsibility to keep it safe,” she added.

Medibank has fought a drawn-out battle

Medibank suffered the attack nearly two years ago in October 2022. Data belonging to millions of former and current customers was exposed in the breach, including various pieces of sensitive information such as health claims and passport numbers.

The health insurance firm originally stated that threat actors gained access to 3.9 million customer records. Even with 3.9 million affected, this would have been a severe breach, with this figure constituting 15% of the county’s population at the time.

It was later revealed, however, that around 9.7 million customers were affected.

Costs continued to mount in 2023 as the firm revealed that it had spent about $26.2 million AUD (£14.7 million) in remediation costs. The firm said at the time it expected costs to rise to more than $45 million.

New data shows the Information Commissioner’s Office (ICO) received more than 15,000 complaints about mishandled Data Subject Access Requests (DSARs) in 2023 – and many are being made by disgruntled ex-employees.

Launching new guidelines on how to respond to DSARs, the ICO recently revealed that the number of complaints it received increased by 13.5% in 2023 compared with the previous year, hitting a total of 15,335.

They amounted to 45% of all complaints received by the ICO.

The ICO is keen to make sure that organizations understand their obligations and respond appropriately.

"What we’re seeing now is that many employers are misunderstanding the nature of subject access requests, or underestimating the importance of responding to requests," said Elanor McCombe, ICO policy group manager.

"For example, employers may be unaware that requests can be submitted informally, such as over social media, or do not have to contain the words ‘subject access request’ in order to qualify as a legally binding request. Similarly, employers may not realize that there is a strict time frame for responding to requests, and this must be kept to."

It's misunderstandings like this that lead to many complaints. However, according to Deborah Margolis, senior associate at GQ|Littler, many DSARs are from disgruntled former employees who use the data as a 'fishing expedition' to obtain copies of documents pre-disclosure, or as a strategy to encourage the employer to reach a settlement with them.

"Responding to DSARs can take up a significant amount of business resources in terms of both cost and management time. Bearing in how much data we create and process about employees on a daily basis, the time spent trawling through documents is overwhelming for many businesses," she said.

"DSARs were intended to help individuals to determine if their personal data was being mishandled but some individuals have now weaponized DSARs with the intention of causing disruption for employers and forcing them into reaching favorable settlements."

Earlier this year, the ICO reprimanded Plymouth City Council and Norfolk County Council for failing to respond to information access requests, while in September 2022 it took action against seven organizations that failed to respond to DSARs.

However, following Brexit, the government has proposed amendments to UK data protection law that would shift it away from GDPR, with a new Data Protection and Digital Information Bill expected to pass this year.

This, the law firm said, is expected to make compliance with DSARs less burdensome for businesses. In particular, it would be easier for organizations to reject or charge a fee for ‘vexatious’ DSARs.

"This would be a welcome change for employers, many of whom feel that the existing rules allows too many opportunities for abuse," Margolis said.

Businesses have forked out €4.5 billion for GDPR violations over the last six years, with Spain, Italy, and Germany imposing the biggest fines.

Research from security firm Nordlayer shows that individual data protection authorities (DPAs) have between them issued 2,072 violation decisions since 2018 under the legislation.

"We've witnessed businesses across industries change their data handling practices and invest in security measures to achieve compliance," said Carlos Salas, cyber security expert at NordLayer.

"While full compliance has been challenging for many companies, the GDPR's impact in empowering individuals and holding organizations accountable for data mishandling cannot be overstated. It has reshaped the digital landscape, forcing a much-needed prioritization of privacy rights."

Spanish businesses were the worst offenders, violating GDPR 842 times and paying out €80 million in fines since 2018. 

Italy was second on the list; while the country's organizations have received half the number of GDPR violations compared with Spain, they've paid nearly three times as much in fines. Companies in Italy, meanwhile, were issued 358 fines and paid nearly €229 million.

German organizations fell victim to 186 fines, resulting in €55 million worth of penalties. Romanian businesses weren't far behind with 179 fines - but have paid only €1.1 million in fines. Poland rounds out the top five, with companies receiving 73 fines, resulting in nearly €4 million losses.

Ireland isn’t scared to dish out GDPR fines

In terms of the biggest payouts, it's Ireland that stands out, with €2.8 billion in fines issued since 2018. The main reason, of course, is that many of the largest tech companies, such as Meta and TikTok, have registered their European subsidiaries there and have been hit with multi-million-dollar fines.

Indeed, it's Meta that's far and away the biggest violator of GDPR, having been slapped with six of the EU's ten biggest fines.

The biggest cost the company €1.2 billion, for insufficient legal basis for data processing in 2023. There were also two fines of around €400 million for non-compliance with general data processing principles.

In 2021, Amazon had to pay €746 million to Luxembourg’s data protection authorities; while last year, TikTok paid €345 million. Google was punished twice in 2021 for having insufficient legal basis for data processing, and paid €90 million and €60 million for separate violations.

And it's insufficient legal basis for data processing that's the most common reason for a fine, with 635 cases since 2018, costing companies €1.6 billion. For non-compliance with general data processing principles, organizations were fined 578 times and paid over €2 billion.

"Achieving and maintaining GDPR compliance is an ongoing journey, not a one-time destination," Salas said.

"Data protection regulations evolve, and cyber threats become more sophisticated, so businesses must remain proactive in their data privacy and security approach."

Data security startup Rubrik has filed to go public on the New York Stock Exchange (NYSE), which, if successful, would make it the first cyber security vendor to complete an IPO in over two years.

The exact size and price of the initial public offering is yet to be disclosed, with Bloomberg reporting the firm could seek to raise $500 to $700 million in September 2023.

Rubrik filed plans for the IPO late on 1 April 2024, and will trade on the New York Stock Exchange under the ticker symbol ‘RBRK’ if successful.

In its SEC filing, Rubrik claimed it has experienced rapid growth in the face of cyber attacks, malicious insiders, and operational disruptions, with its annual recurring subscription (ARR) revenue growing from $532.9 million to $784.0 million as of 31 January 2024, a 47% increase year-on-year.

The data protection specialists announced its total revenue rose by around 5% from $599.8 million to $627.9 million during the same period, boasting over 61,000 customers, 1,742 of which bring in over $100,000 in subscription ARR.

The company’s net losses also rose to approximately $354 million for the fiscal year 2024, climbing from $277.7 million in 2023.

Rubrik’s IPO plans come in the wake of debuts for Reddit and Astera Labs on the NYSE in February, which broke a relative dry spell for IPOs in the last two years.

Before Reddit and Astera Labs went public, the last two venture-backed IPOs in the US were Instacart and Klaviyo in September 2023, which both failed to generate much enthusiasm in the market.

Spiraling data requirements drive high demand for data protection solutions

The growing value of data as a result of digital transformation, cloud adoption, the proliferation of AI tools, and the sheer volume of data being generated today has resulted in an accompanying boom in demand for data protection services.

Software company Rivery estimated that around 90% of the world’s data was created in the last two years, and this figure is expected to double in size every two years subsequently.

Kevin Cole, director of product and marketing at data protection firm Zerto, a subsidiary of HPE, said Rubrik’s IPO filing demonstrates the growing importance of the data protection solutions for organizations across industries. 

“Rubrik's IPO filing is a significant development in the backup industry, coming closely after the news of Cohesity's acquisition of Veritas. This market movement underscores the continued importance of data protection for organizations across all industries and sizes.”

Cole argued the growing volume of data being created, collected, and stored by businesses around the world means demand for products to manage and secure this has similarly ballooned.

“We recognise that solution stacks continue to evolve to keep up with the explosion of data, which is increasingly distributed across edge devices and cloud environments,” he said. 

“This distributed data landscape remains challenging for most companies to manage effectively, making it more important for organizations to rely on vendors who can provide end-to-end solutions across the entire data lifecycle.”

The European Commission infringed data protection rules within its own jurisdiction, according to an investigation by the European Data Protection Supervisor (EPDS).

The European Commission reportedly infringed rules through its management of Microsoft 365 data.  The EDPS found the Commission had broken a number of key provisions, including the “EU’s data protection law for EU institutions, bodies, offices, and agencies.” 

Perhaps most notably, the Commission breached provisions for managing the safe transferral of personal data outside the EU or European Economic Area (EEA).

The EDPS found it failed to provide “appropriate safeguards” to ensure that personal data transferred outside of the EU or EEA was afforded an “essentially equivalent level of protection as guaranteed in the EU/EEA.” 

According to the privacy watchdog, the Commission also failed to clearly specify what type of personal data was to be collected and for what purposes it was to be collected when using Microsoft 365. 

Several infringements concerned “all processing operations” carried out by the Commission when using Microsoft 365, and a “large number of individuals” were therefore affected.

“It is the responsibility of the EU institutions, bodies, offices and agencies (EUIs) to ensure that any processing of personal data outside and inside the EU/EEA, including in the context of cloud-based services, is accompanied by robust data protection safeguards and measures,” said Wojciech Wiewiórowski of the EDPS.

The European Commission’s role as a data controller also formed part of the inquiry, with the investigation extending to data processing and personal data transfers carried out on the commissions behalf.  

The European Commission will face penalties 

On the basis of this investigation's results, the EDPS has ordered the Commission to suspend all the data flows to Microsoft and its affiliates or sub-processors outside of the EU that result from the use of Microsoft 365.

The EU watchdog will also order the Commission to bring its Microsoft 365 processing operations “into compliance with Regulation (EU) 2018/1725.” The Commission must comply with both these orders by 9 December 2024.

“The EDPS considers that the corrective measures it imposes … are appropriate, necessary and proportionate in light of the seriousness and duration of the infringements found,” the watchdog said. 

Noting the important public role of the Commission, however, the EDPS did note that it would look to avoid compromising the Commission’s ability to “carry out its tasks in the public interest.”

Two-in-five UK businesses are failing to offer staff any guidance on the use of artificial intelligence (AI), leading to some risky behavior.

While half of UK office workers are using generative AI at least once a week, and one in five every day, they are not getting the advice they need, research by Veritas finds.

Half said they need guidelines or mandatory policies on generative AI use from their bosses, with 44% offering no guidance at all. 

One in four believe that this would create a more level playing field, 68% believe it is essential to know how to use AI tools in the right way, and 85% believe there should be some form of national or international regulation around AI.

And, it seems, guidance is badly needed. Two-fifths of UK office workers admit that they or a colleague have inputted sensitive information, such as customer, financial or sales data, into a public generative AI tool.

Six-in-ten fail to recognize that doing so could result in sensitive information leaking outside the corporate walls, with a similar number unaware that this can cause their organization to fall foul of data privacy compliance regulations.

"Without guidance from leaders on how or if to utilize generative AI, some employees are using it in ways that put their organizations at risk," said Sonya Duffin, solutions lead at Veritas Technologies.

"Organizations could face regulatory compliance violations or miss out on opportunities to increase efficiency across their entire workforce. Both issues can be resolved with effective generative AI guidelines and policies on what’s OK and what’s not."

Two-fifths of UK office workers are using AI to do their research, 43% to write their emails, and 17% to help write company reports. One in ten say they're simply using it to look good in front of their boss.

However, this is causing division amongst colleagues, with 29% believing that colleagues who are using it should be reported to line managers, and a quarter believing they should either get a pay cut or face disciplinary action.

Under GDPR, anyone inputting data into a generative AI needs to comply with GDPR in terms of legal basis, transparency and security. Organizations should prepare a Data Protection Impact Assessment (DPIA) and limit unnecessary processing.

Organizations developing or using generative AI, says the Information Commissioner's Office (ICO), should be considering their data protection obligations from the outset, taking a data protection by design and by default approach.

"The message is clear: thoughtfully develop and clearly communicate guidelines and policies on the appropriate use of generative AI and combine that with the right data compliance and governance toolset to monitor and manage their implementation and ongoing enforcement," Duffin said.

"Your employees will thank you, and your organization can enjoy the benefits without increasing risk."

The EU’s landmark General Data Protection Regulation (GDPR) is costing companies more to store and manage their data and is causing them to reduce the quantity of data they collect and store, new research indicates. 

The National Bureau of Economic Research (NBER) has issued a working paper looking into how European businesses have responded to the privacy laws just almost 6 years ago in 2018.

The paper constructed an estimate of the increased costs GDPR is incurring on firms using a production function with storage and computation as the primary inputs, estimating a 20% increase in the cost of data on average.

In addition, the authors calculated the implementation of GDPR resulted in a 4% increase in the cost of producing information.

Previous survey evidence cited in the study found GDPR compliance costs typically range from $1.7 million for small to medium-sized enterprises to $70 million for large enterprises.

The study found EU firms had adapted by decreasing their data storage by just over a quarter and their data processing by 15%, relative to comparable US firms.

Speaking to ITPro, Alasdair Anderson, VP and GM of EMEA at Protegrity, said GDPR has made data management more arduous for companies and that although the initial investment spike has subsided, costs to businesses are still high.

“GDPR has undoubtedly added complexity and cost to all businesses working with consumer data. While the investment required has flattened out since the 2018 implementation deadline, the cost of business-as-usual remains stubbornly high.”

Anderson reported he is seeing customers allocate more time and money to their data strategy, but this forced investment has resulted in them generally having better quality data and thus being better placed to take advantage of AI tools.

“Our customers are now spending more time and money on their data than ever before. As commercial investments begin to focus on the enablement of AI, we would expect to see European businesses benefit from higher-quality AI outputs from their better-quality data inputs.”

With stronger enforcement comes greater responsibility

In July 2023, the EU commission proposed a new law aimed at providing data protection authorities with more comprehensive procedural rules for enforcing GDPR in cases that span more than one member state’s jurisdiction.

David Dumont, partner at law firm Hunton Andrews Kurth LLP, told ITPro the law was an attempt to complement the original regulation and address a weakness it exhibited when applied to cross-border cases.

“The European Commission’s proposal is intended to complement, not alter, the GDPR. The aim of the proposed Regulation is to enhance the efficiency of cross-border data protection enforcement, which has been a point of criticism over the past years.”

Dumont argued, however, that the EU and relevant DPAs need to be aware of the responsibility they have when enforcing these regulations, which could result in levying multi-million dollar fines on businesses in the region

The harmonization proposed in July 2023 expanded the scope of their authority, streamlining the process for penalizing firms found to be in violation of the regulations, and authorities should be cognizant of the consequences of a successful prosecution, according to Dumont.

“With more and stronger enforcement by the data protection authorities comes greater responsibility,” he said. 

“Clear procedural rules with adequate safeguards for the defendants’ interests, such as the right to be heard and protective measures for safeguarding the defendants’ confidential information, are pivotal as organizations involved in enforcement proceedings face potentially major consequences, including multi-million euro fines which may end their business. The aim should be better enforcement instead of more.”

Data privacy has become a recurring flashpoint for both consumers and businesses alike in recent years amid a flurry of major data breaches. 

Within the last month, the issue was once again thrust into the public consciousness with news of the largest data leak of all time, known as the ‘mother of all breaches’, that saw more than 26 billion records exposed.

Evolving industry trends have also given rise to more frequent discussions about data privacy through the proliferation of IoT devices, the shift to cloud, increased remote-working, and the rapid adoption of generative artificial intelligence (AI).

Corporate networks globally are growing in size and complexity, resulting in a sprawling attack surface ripe for targeting by increasingly sophisticated threat actors.

Across 2024, industry experts predict that both security threats and breaches will continue to escalate, prompting increased investment from enterprises and a sharpened focus among IT leaders on data privacy and security, according to Greg Clark, director of product management at OpenText.

Speaking to ITPro, Clark said businesses need to take both their data footprint and the threat landscape into account when developing their data strategies.

“Businesses need to understand their data footprint and threat landscape. Only then, they will be able to devise smart strategies needed for the evolving business environments of today,” Clark argued.

“Data discovery tools, especially those that go beyond data mapping or metadata scans, are essential for privacy programs as they help businesses find data, understand risk and set priorities with internal stakeholders and business owners to mitigate compliance and financial risks.”

Mark Molyneux, EMEA CTO at Cohesity, told ITPro the security measures businesses have previously employed to protect data will need to be expanded to reflect the specific threats they will face in 2024.

“Previous concepts that build additional and higher security walls around data and systems no longer do justice to this new world,” he said. “Because even the highest wall becomes permeable when employees click on the wrong things, software products have hundreds of vulnerabilities, and remote working has stretched the entire security architecture.”

“Networks, although they are shielded by thousands of individual tools in large companies, have become much more permeable to hackers,” Molyneux added.

Chief security officer at flexible-work specialist GoTo, Attila Török, suggested shoring-up employee data protection awareness should be a key objective in the year ahead.

“In 2024 businesses should be firing on all cylinders to scale up employee security, utilize zero trust products, continue to enforce a strong acceptable use policy (AUP), and move toward passwordless authentication. These are simple yet powerful ways we can improve and modernize current practices to ensure that cyber threats can’t breach company systems.”

Data privacy will meet AI ‘head-on’ in 2024

Beyond protecting data from external threats, companies also need to be aware of how to maintain privacy while using the data. 

Clark emphasized the attention this requires, particularly when using AI tools, and that firms should employ privacy-enhancing technologies (PET) accordingly.

“These technologies can enable organizations with anonymization or de-identification of personal data (non-reversible masking) that has become increasingly important for protecting unstructured data before it hits the AI pipeline in large language models.

Feeding private, potentially sensitive data into public models can be a dangerous move for businesses and as such they should add further protections to avoid sensitive data being exposed in this way, Clark explained.

“Great AI requires greater data, therefore, businesses must protect the data feeding these models. Encrypting or tokenizing data is also a strategic PET to deploy inside the business to ensure personal data is used responsibly and all privacy obligations are met. Techniques like format-preserving encryption ensure analytics are secure and have referential integrity. PETs help ensure compliance with privacy regulations and build a framework for building trust with customers.”

Audit alliance manager at software company Drata, Martin Davies, said AI’s impact on data protection in 2024 could be dictated by regulatory controls such as the EU commission’s AI Act.

“2024 will be the year when Data Privacy will meet AI head-on, and getting the balance of innovation, regulation and protection right will depend on the development of regulatory control”, Davies said.

He argued regulators will bear much of the responsibility for the level of data protection we see firms adopting in 2024.

“There is a clear responsibility on the part of global regulators to implement requirements that AI companies must adhere to in order to protect the data privacy of the end user and enable them to make informed decisions about how they interact with AI tools.”

Zero trust will be a key tool to bolstering data privacy

Trevor Dearing, director of critical infrastructure at data center and cloud security firm Illumio, told ITPro current threat levels mean breaches are “inevitable” and as such more mature zero trust systems are required.

“Breaches are inevitable in today’s world, so businesses must put in place measures to rapidly contain and limit the likelihood of sensitive data being exposed. Traditional tools like firewalls and intrusion detection systems no longer cut it – you can’t use the past to protect the future.”

Implementing zero trust on corporate networks may cause some headaches, however, as IEEE’s senior member and professor of cyber security at Ulster University Kevin Curran explained.

“Organizations should also make sure that employees have up-to-date security protection on their devices, such as virus checkers, firewalls and device encryption. However, how many actually do this is questionable.”

Recipe kit delivery service HelloFresh has been fined £140,000 by the Information Commissioner's Office (ICO) for pestering customers with tens of millions of spam messages.

According to the data protection regulator, the company sent 79 million spam emails and a million texts in just seven months. The messages were sent on the basis of an opt-in statement which the ICO said didn't make any reference to the sending of marketing via text.

Although there was a reference to marketing via email, this came as part of an age confirmation statement which the regulator said was likely to incentivize customers to agree.

The message read: "Yes, I’d like to receive sample gifts (including alcohol) and other offers, competitions and news via email. By ticking this box I confirm I am over 18 years old".

Customers also weren't properly warned that their data would continue to be used for marketing purposes for up to 24 months after they had cancelled their subscriptions.

"This marked a clear breach of trust of the public by HelloFresh," said Andy Curry, head of investigations at the ICO.

"Customers weren’t told exactly what they’d be opting into, nor was it clear how to opt out. From there, they were hit with a barrage of marketing texts they didn't want or expect, and in some cases, even when they told HelloFresh to stop, the deluge continued."

HelloFresh complaints began in 2022

The ICO investigation began in March 2022 following complaints made to both the ICO and to the 7726 spam message reporting service. In some cases, the company carried on contacting people even after they had asked for this to stop.

"I had previously bought from this company and ensured that I did not consent to marketing material. I was not happy with their service so cancelled my subscription," one complainant said. 

“Recently (last 1-2 months) I have started regularly receiving unsolicited advertising emails from the company, and now they are sending unsolicited text messages."

The emails and texts were sent in contravention of Regulation 22 of the Privacy and Electronic Communications Regulations (PECR), the investigation found.

The opt-out consent statement wasn't, as it should have been, 'specific' and 'informed', as it didn't mention SMS, was unclear and bundled with other aspects, and didn't highlight the fact that customers would carry on receiving messages after they cancelled their HelloFresh subscription.

"In issuing this fine, we are showing that we will take clear and decisive action where we find the law has not been followed," Curry said. "We will always protect the right of customers to choose how their data is used."

The ICO said it's issued more than £2.44 million in fines against companies responsible for nuisance calls, texts and emails since April 2023, with another £2.8 million in 2021/22.

In December, it took action against Daniel George Bentley and his firm Taipan Trading for sending 2.5 million unsolicited direct marketing text messages, issuing an enforcement notice.

The Information Commissioner’s Office (ICO) fined businesses more than £14.3 million for misusing data last year, according to an analysis by cyber security and data protection consultancy CSS Assure.

ICO fines were imposed on 18 businesses, with the ICO also reprimanding 36 companies, issuing enforcement notices against a further 19, and prosecuting four businesses for failing to meet their obligations on information rights.

The year's largest fine, £12.7 million, was imposed on social media platform TikTok for breaching data protection law around the use of children’s personal data, with the ICO estimating that up to 1.4 million under-13s in the UK were able to use the video sharing app in 2020.

Charlotte Riley, director of information security at CSS Assure, said the ICO fines underline the serious repercussions faced by businesses for failing to adhere to robust data protection standards.

"The fines imposed by the ICO in 2023 highlight the serious consequences of misusing data," she said. "Mishandling personal information not only violates data protection laws but also erodes trust among consumers."

"TikTok’s £12.7 million penalty underscores the importance of lawful use of personal data and implementing appropriate safeguards, especially when it involves children," Riley added. "TikTok is a large, well-known brand, and its fine was substantial due to the sheer amount of data involved."

ICO fines issued for marketing violations

There were a combined £310,000 in ICO fines for three marketing firms found to be making a total of 483,051 unsolicited marketing calls to businesses and sending 107 million spam emails to jobseekers, analysis from CSS Assure revealed. 

Similarly, two energy firms were fined a combined £250,000 for making marketing calls to people on the UK’s ‘do not call’ register.

A business support consultancy was also fined £30,000 for sending 558,354 direct marketing SMS messages without valid consent while an appliance service and repair company was fined £200,000 for making more than 1.7 million unsolicited direct marketing calls.

During the second half of the year, 10 companies were collectively fined more than £800,000 for sending a total of 4,698,841 unwanted text messages, 39,906,342 emails, and making 1,937,028 nuisance phone calls.

Riley said the sharpened focus on cracking down on nuisance calls and spam marketing tactics serves a clear message to organizations across the country for the year ahead.

"The fines imposed on businesses for unsolicited calls and text messages, and spam emails, as well as firms for disregarding the 'do not call' register, demonstrate the significant impact of invasive marketing practices," she said.

"These penalties send a clear message that companies must respect individuals’ privacy preferences and refrain from bombarding them with unwanted communications."

The ICO had a “busy year” in 2023

The ICO described 2023 as 'a busy year', noting that it handled 116,000 business service calls and 70,000 public advice calls. 

The watchdog also received more than 33,000 data protection complaints and over 7,000 FOI complaints, with 288 investigations opened and 346 closed.

Its priorities for this year, it said, are to support the new Data Protection and Digital Information (DPDI) bill as it makes its way through Parliament, and to set out clear expectations that privacy and artificial intelligence (AI) go hand in hand.

Speaking at TechUK’s Digital Ethics Summit last month, information commissioner John Edwards said the regulator will be taking a measured approach to AI in 2024, but warned businesses that data privacy standards must be a key consideration.

"I want to make it clear from the very start that we are not against organizations using AI," he said.

"We just want to ensure that they are using AI in sensible, privacy-respectful ways, ensuring that people’s personal information and privacy rights remain protected throughout."

OpenAI’s plans to shift European data processing to Ireland represent a significant step to ensuring GDPR compliance, but questions still remain over its US influence, experts have warned.  

In an email to users, OpenAI said it plans to make its Irish subsidiary the official data controller for customers that live in the European Economic Area (EEA) and Switzerland.

The announcement follows the opening of a Dublin office in September, with the data processing change due to be made on February 15.

"We have changed the OpenAI entity that provides services such as ChatGPT to EEA and Swiss residents to our Irish entity, OpenAI Ireland Limited,” users were told in an email by the firm.

There's also been a similar update to the company's privacy policy.

The move from OpenAI appears to be a concerted effort to reduce regulatory friction across the European Union. The California-based tech giant has been embroiled in a series of data protection-related battles over the last year, with Italian regulators suspending the use of ChatGPT in April 2023 amid GDPR concerns.

Similarly, Polish regulators opened an investigation into the company in September following a complaint from privacy researcher and author of Philosophy of Cybersecurity, Lukasz Olejnik.

A key point of contention is the way OpenAI processes personal data, with critics complaining that it lacks a legal basis to justify the mass collection and storage of data, along with claims that it fails to adequately protect children.

Its activities, it's alleged, breach GDPR in terms of lawful basis, transparency, fairness, data access rights, and privacy by design. Regulators in both Germany and Spain have expressed similar concerns.

In the wake of Italy's decision, the European Data Protection Board (EDPB) announced plans to launch a dedicated task force to foster cooperation and to exchange information on possible enforcement actions by data protection authorities against the company.

The GDPR’s “one-stop-shop” mechanism allows companies operating in the EU to have their privacy overseen by a single lead data supervisory authority, rather than having a free-for-all with each national privacy watchdog able to take action unilaterally.

By moving its European data processing to Ireland, OpenAI aims to ensure that its compliance with GDPR is monitored by the country's Data Protection Commission (DPC).

In this sense, it is following the likes of Google, Apple, Meta and TikTok.

While the DPC has investigated and issued a number of fines against big tech firms, it's widely seen as being both slow and over-lenient in its decisions.

Last year, Ireland’s data protection commissioner Helen Dixon said that while generative AI needed to be regulated, it would be unwise to rush into bans that “really aren't going to stand up”.

Speaking to ITPro, Olejnik said that the move by OpenAI will help attempts to calm regulators across the union, but questioned whether the influence of US operations could create friction further down the line.

"Having a local desk would aid in contact with the local EU regulators in various terms. It will not necessarily function as a go-to place for the needs of the EU GDPR, though," he said.

"It is the US HQ that is making the actual substantial decisions about the designs, so considering the existing way that some EU DPAs decide, it is not necessarily relevant to data processing, at least not always."

Microsoft’s Excel is cost-effective and easy to use, which are major draws for public sector organizations and small businesses. However, Excel has been under the spotlight over the last few months after the data breaches at the Police Service of Northern Ireland (PSNI) saw personal information inadvertently exposed in spreadsheets shared as part of a Freedom of Information (FOI) request.

The fear of another high-profile incident was so great that in September, UK regulator the Information Commissioner’s Office (ICO) issued a warning against using Excel spreadsheets when responding to FOI requests.

There’s no doubt Excel is a flexible tool for data management and analysis, but its openness can lead to security concerns and leave it vulnerable to breaches of regulation such as the General Data Protection Regulation (GDPR).

Many public sector organizations are currently using Excel to manage and analyze their data. What are the risks and benefits of each approach?

How easy is it to use Excel for data analysis?

Excel is well-known and has been around for a long time so ease of use is one of its biggest benefits, says Katie McCullough, CISO at Panzura. “Virtually everyone knows how to navigate an Excel spreadsheet and that's a huge plus when you're trying to implement a system across an organization with varying levels of technical skill.”

Excel enables a variety of data manipulations and calculations, which is why it's often leaned on for data analytics, says McCullough. It’s also specifically aimed at business users and the best Excel courses can teach employees how to use the software to dramatically improve their efficiency at work. However, she says, Excel’s accessibility can be a “double-edged sword”. 

When using the tool for data management, Excel's openness can lead to significant security concerns, says McCullough. “When you're handling sensitive public sector data, the unstructured nature of Excel can make it difficult to maintain control over who has access to the information and how it's being altered.”

Auditability can also be a challenge. “If you can't track the provenance of the data or the changes made to it, you're going to run into problems when you need to substantiate your findings or decisions, says McCullough. “While Excel is a powerful tool for analysis, its use for managing data – especially sensitive information – requires careful consideration of these inherent risks.”

While sensitive data can be easily stored in Excel spreadsheets, this can be hard to do in compliance with data protection policies and procedures. Indeed, Excel was never designed as a data management tool: It is “simply too easy” for users to expose sensitive information to unintended audiences, says Nelson Petracek, CTO at business planning company Board International. 

“Data is not managed in a way that is easily controlled or secured, and users can hide information via hidden tabs and columns, embedded data elements, formatting – or even by moving it to an area outside of the normal viewpoint,” Petracek says.

“This makes it difficult to determine if sensitive data exists in a workbook or Excel application.”

Security in Excel is typically set at a workbook or worksheet level, which is “simply not a fine enough level of granularity to ensure proper data security and privacy”, adds Petracek. “It is also easy to send files over insecure channels, lose track of versions, or for files to be sent or carried outside of an organization’s firewall.”

The risk of Excel macros

Another security issue that has already been the subject of a warning by the UK’s National Cyber Security Centre (NCSC) is macros. These are action scripts used to automate tasks in Excel and are often helpful for obtaining insights within the software. But they can also negatively impact security as Blake Jeffrey, general manager, security and identity at Intelliworx, tells ITPro. “Macros are often created for legitimate reasons, but they can also be used by attackers to gain access to or harm a system, or to bypass other security controls.”

At the same time, building a proper data governance strategy and meeting compliance checks can be a challenge with Excel, says Jeffrey. “Excel lacks the specific features needed to manage complex tasks related to GDPR for example, such as data mapping, consent management, and data subject access request handling.”

The issue is not unique to UK organizations, as the US is impacted by security and data protection concerns too. “In the US and UK, public sector organizations often deal with sensitive data and Excel may not provide the level of security required,” says Jasmine Harrison, account manager at Data Protection People. 

Regulations such as the Health Insurance Portability and Accountability Act (HIPAA) “emphasize stringent data protection measures”, she points out.

Beyond regulation, Microsoft’s own guidance recommends using Excel for data analysis and its software Access for data management – but this is frequently ignored. Experts say Access is a more structured and secure database management system. However, Excel's familiarity and popularity can make it the go-to choice, even when it's not the best fit for data management, says Harrison. 

Excel is also readily available as part of the Microsoft Office suite that most organizations already have, McCullough points out. This means that despite the best intentions of Microsoft's guidance, the “convenience and familiarity of Excel” often leads to its use in scenarios better suited for a dedicated database management system such as Access. But this doesn’t make Excel the best option for database costs, performance, and value in the long run.

Alternatives to Excel for data management

It’s clear Excel is not fit for purpose when it comes to storing sensitive data, but what’s the alternative? While there are other options available, many of the pitfalls are the same, says McCullough. “It’s important to weigh the options against the risks, especially given the recent ICO guidance. The ICO emphasizes the importance of data integrity and security, which are critical for any organization, regardless of size.”

For smaller organizations, the key is to find solutions that maintain the simplicity and user-friendliness of Excel while offering enhanced security and data management features, says McCullough. 

Google Sheets is one alternative to Excel. “It's a familiar spreadsheet environment with the added advantage of automatic Google cloud storage and version control, which is not a perfect solution, but can help with data integrity,” McCullough says. It also allows for easier control of user access, which she says “aligns somewhat” with the ICO's emphasis on data protection.

While other options are available, the likes of OneTrust might be too expensive for smaller organizations, says Harrison. With this in mind, she recommends alternatives such as DataWise, which “may be more budget-friendly in comparison”.

However, it's not just about picking a different spreadsheet tool: Organizations must understand the need for structured data management practices, says McCullough. “Even with alternatives such as Google Sheets, the principles of good data management are the same – knowing where your data is, who has access to it, and ensuring it's backed up and recoverable in the event of an incident.”

To protect your company from the next big data breach, it’s important to assess the tools you use for data management. Ease of use or employee familiarity should never come second to proper data controls.

A new ruling by the Court of Justice of the European Union (CJEU) limits the circumstances in which GDPR fines can be imposed on organizations.

The decision follows the case of a German real estate company, Deutsche Wohnen, after it was accused of retaining customer data longer than necessary by the Berlin Data Protection Commissioner in 2019.

The original fine of €14.5 million was reversed in 2021 on the grounds that, under German law, the company could only be held responsible if a specific individual or executive could be blamed.

However, hearing an appeal on the case, the CJEU ruled that a “data controller may not have an administrative fine imposed on it for an infringement of the GDPR unless that infringement was committed wrongfully; that is to say, intentionally or negligently”.

The result has been welcomed by Deutsche Wohnen.

"The case raised important questions about the application of GDPR," said Kai Mertens, a partner at Squire Patton Bogg, which represented the firm in the case.

"We are pleased that the European Court of Justice has now clarified that only an intentional or negligent infringement of the GDPR may result in an administrative fine."

The court ruled, though, that a controller can be punished for breaching the GDPR if they “could not have been unaware” of the illegality of their actions - regardless of whether they understood that they were in breach of GDPR provisions.

Ruling offers clarity on GDPR fines

Data protection expert Jonathan Kirsop of law firm Pinsent Masons said the decision provides welcome clarification.

"The judgment seems to limit the scope for fines being imposed for more ‘technical’ or administrative breaches where a controller has acted in good faith and with its best efforts to ensure appropriate processes in place," he said.

"That said, fines will still be imposed where a controller should have known that it had committed a breach, whether or not it did so."

The decision applies to any organization that has a subsidiary within the EU that processes the personal data of EU citizens, or that offers goods and services within the union.

Kirsop believes that the UK government and Information Commissioner’s Office (ICO) are likely to adopt the CJEU's approach.

"The CJEU’s finding, as a general rule, reflects how the ICO has tended to seek to enforce the UK GDPR by focusing on those violations which had the most impact and were derived from a materially deficient approach by controllers," he said.

"The UK government is currently seeking to update the UK data protection regime, with the Data Protection and Digital Information Bill currently before parliament, but the Bill maintains the administrative fine framework and principles of the GDPR, notwithstanding that it envisages expanding these to encompass electronic marketing violations."

As part of the ruling, the court also considered a Lithuanian case in which the National Public Health Centre under the Ministry of Health contested a €12,000 fine relating to a mobile app for registering and monitoring the data of people exposed to Covid 19.

The court concluded that an organization found to have breached GDPR can be fined based on the turnover of its parent company, as well as its own turnover - thus increasing potential fines.

"By maintaining that an undertaking may encompass a group of entities – where engaged in a common economic activity – the court is explicit that group turnover will often be the basis for calculation," Kirsop added.

This, he noted, "closes the door for any attempt to create artificial group structures with controllers placed in legal entities with limited turnover."

Nvidia and cloud service provider Scaleway have announced a new partnership aimed at driving the availability of sovereign infrastructure across Europe. 

The two have teamed up to offer European startups cloud credits, access to GPUs, Nvidia AI Enterprise software, and large language models (LLMs) all on sovereign infrastructure based in the EU.

Through the deal, Scaleway, a subsidiary of French telecoms firm Iliad, is offering cloud credits for access to its AI supercomputer cluster, with 1,016 Nvidia H100 Tensor Core GPUs.

The firm said its sovereign infrastructure push aims to ensure compliance with EU data protection legislation. The firm’s data centers hold compliance certifications that ensure data security for critical services such as healthcare and public services.

This expanded access to sovereign computing comes via Nvidia's Inception program, a free global scheme that provides technical guidance, training, discounts, and networking opportunities. 

It's already attracted startups such as Hugging Face, which hosts operations in both the US and France.

"AI is the new way of building technology, and making the fastest AI accelerators accessible within regional clouds is key to democratizing AI across the world, enabling enterprises and startups to build the experiences of tomorrow," said Jeff Boudier, head of product at Hugging Face.

Scaleway said its new Nabuchodonosor supercomputer - an Nvidia DGX SuperPOD with 127 Nvidia DGX H100 systems - will help startups in France and across Europe scale up AI workloads.

Regional Inception members will also be able to access Nvidia AI Enterprise software on Scaleway Marketplace, including the Nvidia NeMo framework and pretrained models for building large language models. 

Access to Nvidia Rapids for accelerated data science will also be offered alongside options for Nvidia Triton Inference Server and Nvidia TensorRT-LLM for boosting inference.

This will offer access to cloud computing credits, Nvidia Deep Learning Institute courses, technology experts, preferred pricing on hardware and software, and guidance on the latest software development kits and AI frameworks.

 Heightened data sovereignty concerns 

Under EU regulations, cloud services must be operated and personal data held within the EU to ensure data security and privacy standards. This practice has been introduced due to lingering concerns that data could be shared with US government agencies. 

Data sovereignty has become a regulatory flashpoint in recent months, with proposed new rules potentially requiring non-EU cloud providers such as Microsoft, Google, and AWS to enter into partnership with EU firms if they want to operate within the union.

Serge Lemonde, Nvidia Inception program lead for EMEA and India, said the partnership will help shore up data sovereignty efforts for participating organizations.

"When doing business in Europe, US companies, for example, need to comply with EU regulations on sovereignty to secure data against access from foreign adversaries or entities," he said. 

"Noncompliance risks data vulnerabilities, financial penalties and legal consequences."

Technology experts have called on the UK government to accelerate efforts to push through the Data Protection and Digital Information (DPDI) Bill during the current parliament. 

Chris Combemale, CEO of the Data & Marketing Association (DMA) urged the government to bring forward the legislation as quickly as possible in the wake of the King’s speech on Tuesday 7 November. 

The DPDI bill will see the UK diverge from the EU’s GDPR legislation, which the government believes will boost the economy, encourage innovation, and reduce cumbersome red tape for businesses across the country. 

"The Bill will create an innovative and flexible data protection regime which maintains the UK’s high standards of data protection,” the government said previously. 

"At the same time, we will reduce burdens on businesses and researchers, and enable innovation in science, innovation and technology that advance the health and prosperity of society to the benefit of the British people."

Under the terms of the bill, only organizations whose processing activities are likely to pose high risks to individuals' rights and freedoms will need to have a data protection officer and conduct risk assessments. 

Customer data can be shared to provide services such as personalized market comparisons and account management, and more organizations will be exempt from the rules on consent to cookies.

Crucially, the definition of 'legitimate interest' will be clarified to include attracting and retaining customers.

The bill was first introduced in summer 2022, but was withdrawn in March this year to be replaced by a new version aimed at managing a delicate balance between reducing regulation and retaining the data adequacy deal the UK currently holds with the EU.  

Combemale said momentum on pushing through the bill must be stepped up in order to ensure UK businesses can maximize the use of data and unlock economic benefits. 

"Data privacy reforms included within the DPDI Bill are key to unlocking business growth and realizing the full potential of the UK digital economy, by further enabling businesses to use customer insights to simultaneously improve the productivity of businesses and create relevance for customers," he said.

Combemale pointed to DMA research that shows two-thirds of UK-based SMBs are keen to see data privacy reform and the removal of needless red tape. 

Nearly half (43%) of survey respondents said their business growth has been stunted by GDPR since its introduction. 

Meanwhile, over three-quarters believe that the processing of personal data is vital to the growth and success of their business. 79% of respondents stated that greater certainty around the use of legitimate interest as a legal basis for direct marketing would make it easier to build customer bases.  

"There is strong support for these opportunities across the UK’s SME community, as demonstrated by our latest research, so we would urge the UK Parliament to complete passage without hesitation,”  Combemale said. 

The bill is now at the report stage and awaiting its third reading before progressing to the House of Lords.

The UK’s Information Commissioner’s Office (ICO) has issued an advisory to public bodies urging them to “stop using spreadsheets” when responding to requests made under the Freedom of Information Act 2000 (FoI). 

The advisory notice called for an “immediate end” to the use of Excel spreadsheets when responding to public requests for information, and outlined a series of recommendations for public authorities to follow. 

The ICO listed a number of core recommendations for responses. Public bodies have been advised against replying to FoI requests with spreadsheets containing “hundreds or thousands of rows”.

A recommendation to improve investment in data management systems that “support data integrity” was included in the guidance.

In addition, police services were advised to “convert spreadsheets and sensitive metadata into open reusable formats, such as comma-separated value (CSV) files”.

The advisory also called for better staff training for those involved in disclosing information to prevent the exposure of sensitive data. 

UK information commissioner John Edwards said it’s “imperative” that robust measures are maintained by public authorities when dealing with personal information. 

“The advice we have issued sets out the bare minimum that public authorities should be doing to protect personal data when responding to information access requests, and to reassure the people they serve, and their staff, that their information is in safe hands.”

While the ICO did not explicitly cite recent incidents, the advisory notice follows a series of FoI-related data protection blunders at UK police services across the country. 

Personal information belonging to thousands of police officers and staff in Northern Ireland was exposed in August after a document was mistakenly uploaded in response to a freedom of information request.  

The data breach exposed the names of around 10,000 actively serving officers and civilian staff. 

Within the space of a week, this incident was followed by breaches at two other forces elsewhere in the UK. 

Norfolk and Suffolk police revealed a “technical issue” that resulted in personally identifiable information being exposed during a routine freedom of information response. 

Details of hundreds of crime victims, suspects, and witnesses were exposed in the incidents. Much of the information leaked pertained to domestic abuse, assault, theft, and sexual offense cases.

Both police services have since apologized for the data protection blunders.  

“The recent personal data breaches are a reminder that data protection is, first and foremost, about people,” Edwards said. 

“We have seen both the immediate and ongoing impact that the release of such sensitive personal information has had on the individuals and families involved, and that is why I have taken this action.”

Asking a customer to change their backup solution can be trickier than asking them to change any other part of their IT setup. 

When a customer is comfortable with their backup and trusts it, there’s a perception that changing it means taking a risk with something unknown. 

But the result is a trend whereby backup solutions tend to be taken on by an accommodating MSP, rather than switching the customer to the MSP’s preferred solution. 

Unfortunately, for the MSPs who agree to this, this can quickly lead to maintaining several different backup products. Keeping a few customers happy can quickly become a major headache and a drain on resources. 

The pitfalls of multiple backup solutions

MSPs often manage four or more backup solutions at once. Sometimes these are at different stages of maturity — one is being onboarded, another is being sunset, and yet another is used for long-term retention — while others are maintained due to customer demand. 

This can get increasingly out of control. 

Each additional backup solution means more cost and not reaping the benefits of scale that comes from serving many customers with the same solution. Each solution means more complexity and more opportunity for something to go wrong. 

When almost any other system goes wrong, the problem will be flagged immediately, usually by the customer complaining. 

Backup, on the other hand, has the potential to go wrong without anyone noticing. It shouldn’t, of course, automatic alerts and dashboards should flag up the problem, but any sensible MSP won’t rely on this alone. They’ll want to check — and checking on several solutions obviously takes more time.

There are also additional costs thanks to the need for patches on multiple systems and training staff on all systems. Inevitably, with multiple solutions, some staff will be experts on some but not others, which can cause issues when staff leave or even just take time off. 

Knowledge gaps are far more common when there are too many solutions to maintain. MSPs need to either tackle this problem before it takes hold or start to change how they work with their customers when it comes to protecting their data.  

Don’t sell ‘backup’

Of course, when we say, “don’t sell backup”, we don’t mean it quite as literally as it first appears. MSPs shouldn’t be selling their customers on a specific backup solution. Instead, they should be selling data protection services.

What does this mean in practice? MSP customers shouldn’t have to care about the name of a product — all they need to know is the agreed SLA and recovery targets. 

How this is done should be down to the MSP, rather than the customer. All the customer needs to care about is their business remaining operational should the worst happen. 

MSPs and their customers should spend time working out what will be protected (data, systems, applications), how often backups will take place, how quickly it can be recovered, and what it will cost. 

People might care about the logo on the front of the car they are driving — they care much less about who made the vehicle if they’re taking transit — all they care about is whether it’s comfortable and gets them there on time.  

This is easier said than done. Some customers, as mentioned above, may be unwilling to change what already works for them. Changing the conversation to targets and SLAs over solutions may help, but this is in effect a sales conversation much like any other, with a need to outline the benefits and objections to overcome. 

No MSP would want to say “no” to a potential customer, but they need to keep in mind that taking on an extra product is not trivial, and the time spent on onboarding and training — among other costs — has the potential to drastically reduce how profitable that customer could be. 

MSPs have spent a great deal of time and energy shifting from old break/fix business models. Working with multiple backup solutions due to customer demand is in some ways a holdover from those old ways of working. 

Taking a firm line, while selling the benefits of their preferred data protection services, is key to making backup a profitable part of the business. And it’s vital for educating on customer security too, which should always be the role of the MSP.