DPM Weekly Insights - November 20 2025
- Gilad Yaron
- 2 days ago
- 2 min read
This week, we spotlight how regulation, innovation and risk in data protection are converging, highlighting the tension between enabling digital progress and safeguarding individual rights.
This weekly brief is crafted for privacy practitioners, compliance leads and anyone passionate about data protection, responsible AI and practical risk management.
🗂 This Week’s Highlights
🧭 European regulator proposes major digital law rollback
🇮🇳 India enforces stricter data‑collection rules under its privacy law
🧠 Why tech firms must sharpen their AI training‑data practices
🧭 European regulator proposes major digital law rollback
The European Commission announced a package of changes under its “digital omnibus” initiative: key parts of the Artificial Intelligence Act would be delayed by up to 18 months, and some provisions of the General Data Protection Regulation (GDPR) would be relaxed — including allowing companies to use personal data for AI training without explicit consent.
Why it matters: This development sends ripples through the global data‑protection ecosystem by signalling that even “gold standard” regulation like the GDPR may be subject to political/economic re‑alignment.
Lesson Learned: Keep an eye on regulatory drift — organisations must anticipate change, not assume rules will only tighten.
🇮🇳 India enforces stricter data‑collection rules under its privacy law
Under the Digital Personal Data Protection Act, 2023 (DPDP Act) in India, companies are now required to restrict collection of personal data to specific, defined purposes; provide clearer justifications; allow user opt‑outs; and report data breaches.
Why it matters: With India as a massive digital market, this marks a considerable step towards operationalising privacy law — it underscores that regulatory focus isn’t only in Europe or North America.
Lesson Learned: If you operate or serve users in India, adapt data‑collection and purpose‑limitation frameworks now — don’t wait for later.
🧠 Why tech firms must sharpen their AI training‑data practices
As regulators and civil‑society groups spotlight how personal and behavioural data feed AI systems, the margin for error in training‑data governance is shrinking. The European proposal above heightens this focus.
Why it matters: Using personal data to train AI without appropriate legal basis opens both compliance and reputational risk — especially as jurisdictions evolve rules in this space.
Lesson Learned: Review your AI‑training data flows: do you have proper legal basis, documentation of purpose, user consent/opt‑out options and data‑minimisation measures in place?
🔍 Final Reflection
This week’s stories lay bare a consistent theme: the interplay between innovation momentum (especially in AI) and the obligations of privacy and data protection. Whether it’s a regulator loosening rules to enable start‑ups, or a jurisdiction enforcing sharper constraints on data collection organisations must navigate both ends of that spectrum. Now is the time to brace for change, remain agile in governance, and embed data‑protection thinking ahead of the curve.
Your Checklist for the Week:
Review any data‑collection practices for alignment with purpose‑limitation and minimisation.
Audit AI training‑data workflows: legal basis, documentation, rights management.
Monitor upcoming regulatory proposals (especially in Europe and India) for early impact on your compliance posture.
Because #DataProtectionMatters
— Your DPM Weekly Insights team
Comments