AI Data Privacy & Governance — Weekly Market Intelligence Brief

Week of 28 June 2026 | Compiled by Team Paringa

A weekly digest of significant developments in AI data privacy, PII governance, and the regulatory landscape for enterprises deploying AI. For CTOs, data officers, compliance leads, and legal teams working through the intersection of AI adoption and data protection.

SECTION 1 — What Happened This Week

🔴 UK Data (Use and Access) Act Now in Force — ICO Sets Out New Enforcement Powers (23 June 2026)

The UK's Data (Use and Access) Act 2025 (DUAA) commenced on 19 June 2026, and the ICO published a significant blog post on 23 June marking the milestone and detailing its new enforcement posture.

The most immediate operational requirement: from 19 June, all UK data controllers must have a formal data protection complaints procedure in place. Complaints must be acknowledged within 30 days regardless of the channel through which they arrive — including social media. Controllers must maintain logs of complaint receipt dates, investigation methods, and outcome communications.

The ICO's new enforcement powers under DUAA are materially more significant. PECR fines can now reach £17.5 million or 4% of global turnover (up from a previous cap of £500,000 — a 35-fold increase). The ICO can now compel witnesses to attend interviews and require technical reports from approved persons. And in a signal with long-term implications for AI governance, the ICO announced it is beginning work on a new statutory code of practice covering AI and automated decision making.

What this means in practice: the UK's regulatory framework for personal data just became substantially more powerful. The complaints procedure requirement is not a technicality — it is an operational process that must exist and be documented before a complaint arrives. The ICO has been explicit that it will use its new powers in the most serious cases, starting immediately.

Sources: ICO — One year on: marking the 12-month commencement of the DUAA (23 June 2026) | CMS Law — DUAA new statutory rules on complaints | Bratby Law — DUAA in Force ICO Enforcement

🔴 EU AI Act High-Risk AI Enforcement — 35 Days to August 2, 2026

The most significant AI compliance deadline of the year is now 35 days away. On 2 August 2026, the bulk of EU AI Act obligations on high-risk AI systems become enforceable — including mandatory data governance (Article 10), risk management documentation (Article 9), technical documentation (Article 11), human oversight requirements (Article 14), and accuracy and robustness standards (Article 15).

Article 10 is the data layer obligation that will be most difficult to satisfy in a compressed timeline. It requires providers of high-risk AI systems to document the origin, relevance, representativeness, and potential biases of training, validation, and testing datasets. This is not a policy document exercise — it requires actual knowledge of what data was used to train each system, where it came from, and what steps were taken to check it for bias. Fines for non-compliance reach up to €15 million or 3% of global annual turnover, whichever is higher.

The Cloud Security Alliance has documented a significant enterprise readiness gap, with many organisations still at nascent stages of compliance program maturity with five weeks to the deadline.

Sources: Cloud Security Alliance — EU AI Act High-Risk Compliance Deadline | EU Commission — AI Act | Legiscope — EU AI Act Deadlines 2026–2027

The Article 10 data governance requirement is fundamentally a data flow question: what personal data entered your AI training pipeline, from what source, processed under what legal basis, with what controls? Organisations that have been running AI without a structured approach to data provenance typically find they cannot answer this confidently. Mapping the AI data landscape before designing the control architecture is the practical first step — and it is also the step most organisations skip.

🟡 EU Parliament Endorses Digital Omnibus AI Act Amendments — Data Governance Deadlines Unchanged (16 June 2026)

The European Parliament formally endorsed the Digital Omnibus provisional agreement on 16 June 2026 — the first set of amendments to the EU AI Act since its adoption. Key changes: obligations for use-based high-risk AI systems are extended from 2 August 2026 to 2 December 2027 (16 months). The watermarking requirement for AI-generated synthetic content moves from August to December 2026. A new prohibition on AI systems generating non-consensual intimate images takes effect December 2026.

However, and this point is creating significant confusion in the market: the Omnibus delay applies to a specific category of high-risk AI defined by use rather than product type. It does not delay Article 10 data governance requirements for most AI providers. The August 2, 2026 deadline for the bulk of provider-side obligations remains unchanged.

Organisations that have absorbed the headline "AI Act deadline extended" without reading the fine print are materially misjudging their compliance position.

Sources: EU Council — AI Act simplification agreement (7 May 2026) | White & Case — EU Agrees Digital Omnibus | OneTrust — How Digital Omnibus Reshapes AI Act Timelines

🟡 GDPR Enforcement at Record Pace: €600 Million in Fines in First Half 2026

GDPR enforcement has reached its highest velocity since the regulation came into force. More than €600 million in fines were issued in the first half of 2026 — approaching the total for all of 2024 — with daily breach notifications exceeding 443 per day, the highest rate since 2018.

The enforcement pattern has shifted materially. Two-thirds of UK ICO penalties in the first half of the year addressed security failures at large organisations rather than marketing or consent violations. In May 2026, France's CNIL imposed a €5 million fine on IQVIA Operations France, a major healthcare analytics company, for failures to implement adequate safeguards on its health data warehouses.

The IQVIA fine is instructive: it targeted the infrastructure layer where sensitive data is stored and processed, not the consent or marketing layer. This is where regulatory attention is now concentrated — on whether organisations have genuine technical controls around sensitive data at rest, not just consent policies on their websites.

Sources: SecurityWall — GDPR Fines Tracker 2026 | Kiteworks — GDPR Fines and Data Privacy Enforcement 2026 | UniConsent — GDPR Enforcement and Fines 2026

The IQVIA fine illustrates where GDPR enforcement is heading: regulators are now examining the technical architecture around sensitive data, not just the consent notices on top of it. A data warehouse containing health records, financial data, or other PII that lacks access controls, audit logging, and purpose limitation at the data layer is now the primary enforcement target. The question organisations need to answer isn't "do we have a privacy policy?" — it's "can we demonstrate that our sensitive data infrastructure has adequate technical safeguards?"

SECTION 2 — What Enterprises Are Dealing With on AI Data Privacy

The Article 10 Problem: When Your AI Can't Explain What It Was Trained On

The most common question surfacing in AI governance conversations in June 2026 is one that seems straightforward but is surprisingly difficult to answer: "What personal data did this AI system use during training, and where did it come from?"

For AI systems built without structured data governance from the outset, answering this question requires reconstructing data lineage that may not have been tracked. Training pipelines are often assembled from multiple internal data sources, open datasets, vendor data, and historical records — with the assumption that "we'll sort out the governance later." Later is now, and "sort it out" means documented evidence, not good intentions.

The regulatory frameworks that matter most right now all converge on this question. The EU AI Act's Article 10 requires it. The UK DUAA's expanded ICO powers make the cost of an inadequate answer substantially higher. GDPR enforcement under Article 5(1)(e) data minimisation principles is already being applied to AI training pipelines.

The practical challenge is that most enterprise AI teams have built systems — often recently, often on capable foundation models — without maintaining the data governance documentation that these frameworks now require. The systems work. The documentation doesn't exist.

The discovery problem typically precedes the technical solution problem. Organisations that implement a PII vault or tokenisation architecture before they understand their AI data flows often find they've engineered controls in the wrong places. A structured assessment of AI data flows — mapping where personal data enters AI systems, where it persists, and where it crosses jurisdictional or system boundaries — is the prerequisite that makes the technical control investment effective. Starting with the mapping typically reduces the scope of what needs to be controlled, which reduces both cost and complexity.

Three Things Worth Watching Next Week

1. EU AI Act August 2 countdown — with 35 days to the general application date, the next two weeks will see increasing compliance guidance, last-minute vendor announcements, and early questions about how Article 10 will be enforced in practice. Watch for any European AI Office enforcement signals or guidance publications.

2. ICO statutory AI code of practice development — the ICO's announcement that it is beginning work on a statutory code on AI and automated decision making is a significant signal. Early consultation papers from the ICO on AI data governance will set UK-specific requirements that may diverge from EU AI Act standards. Watch for ICO consultation launches over the summer.

3. GDPR enforcement focus on AI data pipelines — with the EU AI Act bringing data governance requirements into sharper focus, expect coordinated enforcement actions from EU data protection authorities targeting specifically how personal data is handled in AI training and inference pipelines. The IQVIA fine may be the first of a pattern.

Questions about AI data privacy compliance or want to talk through what the DUAA, EU AI Act, or GDPR implications mean for your AI deployments?

hello@paringa.ai

Paringa specialises in AI governance, data privacy, and security for enterprise organisations. We work with data privacy specialists to help enterprises understand and control what their AI systems see, process, and retain — in a way that satisfies regulatory requirements without blocking AI adoption. If this brief is relevant to challenges you're working through, we'd be glad to have a conversation.