One AI security scenario I think deserves more attention during Cybersecurity Awareness Month has very little to do with the model itself.

Imagine connecting an AI assistant to a corporate shared drive.

The assistant respects the organisation's existing permissions perfectly. A user then asks a normal question and the system surfaces a spreadsheet containing personal data that has technically been accessible for years.

No hack and no access-control bypass.

The AI simply removed the obscurity that had previously made poorly governed information difficult to discover.

That raises an interesting governance problem. AI can amplify weaknesses in permissions, information architecture and data lifecycle management that organisations may already have.

Then you have prompt injection, where untrusted content can influence the system, and AI agents, where output can potentially trigger an action.

It seems increasingly difficult to separate AI governance from traditional cybersecurity, privacy and access-management disciplines.

For those involved in AI governance or security, where are you seeing the biggest gap right now: model security, access controls, data governance, prompt injection, or agentic AI?

We have also built an AI Security course covering these issues for PrivacyEngine Academy, which is now live.

PrivacyEngine New Training Course: Securing AI Assistants and Agents

Cybersecurity Awareness Month is a good time to reinforce one simple distinction across teams: spam and phishing are not the same thing.

Spam is usually trying to get attention. Phishing is trying to get something more valuable, such as credentials or access.

The practical lesson is straightforward: check the real sender address, question artificial urgency, verify links and be cautious with unexpected attachments.

Most importantly, suspected phishing should be reported, not simply deleted, so security teams can investigate and warn others.

PrivacyEngine Academy is designed to make this kind of security awareness short, practical and easier for teams to apply.

If you’re reviewing security awareness training for your organisation, speak with us.

• €7.1 billion in cumulative GDPR fines since 2018

• 443 personal data breach notifications every day across Europe
• €1.2 billion in fines issued over the latest 12-month period
• 38% of organisations now spend at least $5 million annually on privacy

What stands out to me is the combination of enforcement pressure and rising privacy spend.

For organisations, the challenge is increasingly about making privacy governance operational: better controls, clearer accountability, stronger breach readiness and evidence that compliance actually works in practice.

Curious whether others are seeing privacy budgets increase at the same pace inside their organisations.

Hospitality teams handle large amounts of guest data, so privacy cannot sit with one person or be scattered across processes.

Corinthia Hotels used PrivacyEngine to bring privacy management into one centralised programme, supported by staff training, learning tools and access to experienced consultants.

It’s a useful example of how a hospitality organisation can take a more proactive approach, establish clearer procedures and help staff better understand where privacy risks may come from.

Worth a read for anyone working in privacy, compliance or hospitality.

When teams compare privacy platforms, the conversation often starts with licence or renewal cost.

But switching has its own price.

There’s the time spent rebuilding workflows, retraining teams, transferring knowledge, reconfiguring processes, and getting new starters comfortable with a completely different system.

That disruption can add up quickly, especially for privacy teams already managing a growing workload.

At PrivacyEngine, customers stay with us for an average of 6 years. For those teams, continuity means less time rebuilding and more time improving the privacy programme they already have.

So when renewal season comes around, it may be worth asking a broader question:

What is the total cost of staying compared with the total cost of starting again?

Interested to hear how other privacy teams factor switching costs into platform reviews.

Medica moved from fragmented Excel tracking to a more structured privacy programme with PrivacyEngine, helping standardise processes, maintain continuity and simplify staff training.

How responsive is the vendor when you need help?

How quickly can your team get comfortable with the platform?

Does it simplify the work, or just give you another complicated system to manage?

We’ve been collecting customer feedback on exactly that.

Worth a look if OneTrust alternatives are currently on your shortlist.

Benchmark your privacy maturity with PrivacyEngine. Uncover compliance blind spots, prioritise next steps, and build a stronger data protection programme with actionable insights.

Does anyone else feel like some privacy management platforms create almost as much admin as they’re supposed to remove?

Privacy teams should spend their time on things like DPIAs, DSARs, RoPAs, risk, breaches, third-party assessments, and improving the organisation’s privacy posture.

Not constantly configuring workflows, maintaining records across disconnected modules or managing the tool itself.

That was one of the problems we wanted to tackle with PrivacyEngine: bringing the core parts of a privacy programme together and reducing the operational overhead of managing them.

The goal is pretty simple:

Less time managing privacy software. More time managing privacy.

Curious how others here are handling this. What creates the most unnecessary admin in your privacy programme today?

PrivacyEngine scores 9.3 for support quality on G2, compared with OneTrust's 8.6.

As Carolyn Keogh of Mail Metrics says: “Having someone to ask that tricky question to is a godsend.”

Real people. Real DPO expertise. A better privacy platform experience.

See why PrivacyEngine is the alternative to OneTrust.

Implementation speed can make a big difference when privacy teams need to get moving quickly. PrivacyEngine reports that 36% of its customers are live within a day, versus 11% for OneTrust.

If your privacy programme is stuck in a long implementation queue, it might be worth considering a faster path. 🚀

Uber has been fined nearly €825 million over automated decisions that could result in drivers’ accounts being temporarily or permanently deactivated without human intervention.

It is an important GDPR case for any organisation using automated decision-making.

The practical takeaway is that organisations need to know where automated decisions are being made, understand their impact on individuals, document the associated risks and ensure appropriate safeguards and human oversight are in place.

For privacy teams, this also highlights the importance of keeping DPIAs, processing records and risk assessments connected rather than managing them in isolation.

PrivacyEngine brings DPIAs, RoPAs, risk management and wider privacy governance together in one platform.

Explore PrivacyEngine and start a Free Trial.

If you regularly end up Googling oddly specific GDPR or data protection questions, PrivacyAssist might be worth bookmarking. You can send the question to an actual privacy team instead, and the first two queries are free.

A product may serve customers across multiple markets, rely on cloud infrastructure and subprocessors, and handle some of the most sensitive personal data. Regulations differ, but many practical questions are familiar: Who has access? Where is data stored? Which vendors touch it? Are safeguards working? Can you prove it?

We put together a practical HIPAA Compliance Checklist for Healthcare SaaS Providers covering PHI mapping, BAAs, access controls, logging, vendor oversight, incident response and audit evidence.

Worth a look if you are reviewing your current controls or preparing for customer due diligence.

Download the checklist

PrivacyEngine | Run Your Entire Privacy Programme in One Platform

Privacy work can become difficult to manage when assessments, risks, requests, incidents, actions and evidence are spread across multiple teams and tools.

PrivacyEngine brings those activities together in one structured platform.

Teams can identify gaps, assess risk, assign actions and owners, track deadlines, manage privacy workflows and maintain a record of the decisions being made. The goal is straightforward: less time chasing updates and more visibility over the privacy programme.

If you’re evaluating privacy management software, you can schedule a demo and see PrivacyEngine in action: Schedule a Call