This month, GRC Solutions’ Privacy division participated in the ICO’s (Information Commission’s Office’s) Data Protection Practitioners’ Conference (DPPC), held on 13 October 2026. This coincided with the CEDPO DPO Conference in Brussels on 12–13 October and the Brussels Privacy Symposium, organised by the Future of Privacy Forum and Brussels Privacy Hub, on 13 October.
The ICO’s conference agenda addresses everyday operational challenges, while the Brussels discussions explore the GDPR’s (General Data Protection Regulation’s) development a decade after its adoption, the proposed Digital Omnibus reforms and privacy’s place within Europe’s wider digital framework.
A common question connects these discussions: how can organisations respond to regulatory and technological change while protecting people and enabling responsible innovation?
Priorities shaping privacy programmes
The main priorities shaping privacy programmes are:
- Organisations need to translate applicable changes under the UK’s DUAA (Data (Use and Access) Act 2025) into practical policies, procedures and training. Alongside this, monitoring proposed EU reforms will help organisations prepare while keeping current obligations clearly in view.
- AI governance starts with understanding which systems are used, what data they process and how they affect individuals. Priorities include risk and impact assessments, transparency, data quality, meaningful human oversight and safeguards for automated decision-making. Emerging agentic AI adds further questions about control and accountability. The ICO’s published AI keynote presentation provides a resource for further exploration.
- DSARs (data subject access requests) and data protection complaints require clear ownership, proportionate searches, consistent decisions and accessible communication. For public authorities, Freedom of Information Act responsibilities also call for effective processes, particularly as workloads grow and AI changes how requests are submitted and managed.
- Cookies and similar technologies, consent mechanisms and relevant communications need regular review. Organisations should ensure that the choices offered to people reflect what their systems actually do, with clear responsibility for implementation and monitoring.
- Accurate data mapping remains essential: where information goes, who can access it and which safeguards apply. Transfer arrangements should be considered alongside supplier oversight, cloud services and AI tools, including overseas access to personal data.
- Privacy and security teams need coordinated prevention, detection and response arrangements. Proportionate controls, clear escalation routes, incident exercises and sound notification assessments are central to preparedness. Lessons from breaches, reprimands and enforcement should lead to improvements in controls, training and leadership oversight.
- Collecting only what is necessary, restricting access, applying justified retention periods and making deletion effective can reduce exposure and improve governance. These principles also support responsible research, innovation and data sharing.
- DPOs (data protection officers) and privacy teams need the independence, expertise and access to leadership required to influence decisions. Documented assessments, clear responsibilities and collaboration across legal, technology, security and business teams help turn privacy commitments into everyday practice.
Privacy and AI action plan: where to start
We recommend using these themes to review and refresh your organisation’s privacy and AI action plan.
Identify the most significant gaps, prioritise them according to their impact on individuals and the business, assign accountable owners and agree achievable milestones.
For AI, start by completing an inventory of systems and use cases, then assess your organisation’s role, relevant obligations and potential risks. For existing privacy operations, regularly test whether rights handling, complaints, consent management, transfer arrangements, retention and breach response work effectively in practice.
How GRC Solutions can help
Our Privacy division supports organisations through privacy programme reviews, gap assessments, policy and process development, impact assessments, training, and ongoing advisory support.
Our new AI services extend this support to AI governance and EU AI Act readiness, including AI Act authorised representative services and help with AI risk and impact assessments, such as FRIAs (fundamental rights impact assessments) and DPIAs (data protection impact assessments).