Data Protection Commission Ireland’s Post

Amended Reg S-P gives advisers no more than 30 days to notify clients after becoming aware of unauthorized access to sensitive customer information. Advisers with $1.5B or less in AUM have been in scope since June 3, 2026. Larger firms since December 3, 2025. The clock is short. The hard part is the first day: what was accessed, when, and by whom. Our compromise assessments answer that with evidence, so your notice decision holds up.

All of us having our most personal data out there in 100s of data brokers is bad enough. Now we find out just how sketchy some of those data brokers were. Some created many different domains, in many different countries, all to stay ahead of lawsuits against them for repeatedly and apparently intentionally violating numerous laws. In fact, one, Radaris, had a judgement against it for refusing legal requests to remove private info of people working in law enforcement. That caused it to lose its domain as part of implementing the judgment against it. This is why YouMail now not only protects against robocalls, but also works to get personal data like phone number removed from as many data brokers as we can, so fewer organizations can target you in the first place. People are shocked when our app shows them how much personal info about them is so readily available. At least this way they can do something about it. (And yes, you'll never get your info off the dark web, which is why you need tools to block all sorts of scam calls in the first place - but at least you can work to have it available to fewer "legit" telemarketers.) https://lnkd.in/gWaFKy8t

Skip tracing, explained in one post. The name comes from "skipping town." You start with details that went stale — an old address, a phone that no longer answers, an email that bounces — and match them against consumer records to find what changed. Who does it every day: — collections teams reaching people they're entitled to contact — process servers delivering court documents — real-estate investors reaching absentee owners — insurers reconnecting with policyholders and beneficiaries What they have in common: a legitimate reason to reach one specific, known person. Skip tracing helps you locate someone. It isn't surveillance. And a database match is a lead, not proof. A person verifies it before anyone acts on it. Our plain-language guide: https://lnkd.in/ghBdcmDH #SkipTracing #DataQuality #Collections

A system's own account of what it did is not evidence. Evidence requires two things: a tamper-proof record where alterations leave traces, and independent verification without trusting the system itself. An agent's log fails both tests. The same software that acted also wrote the record. If it malfunctions or gets compromised, rewriting the log is often easier than fixing the bug. A missing bad entry proves nothing, consistent with both nothing bad happening and the entry being erased. This matters as autonomy accelerates. Agents now handle approvals, financial transfers, data access. The permission, guardrail, and audit questions collapse into one: if this agent acted, can you prove it to someone who doesn't trust the system? If your agent processed transactions yesterday and needed to prove each one to a customer, regulator, or court, where would that proof come from? The agent's own logs, or somewhere the agent cannot reach?

A system's own account of what it did is not evidence. Evidence requires two things: a tamper-proof record where alterations leave traces, and independent verification without trusting the system itself. An agent's log fails both tests. The same software that acted also wrote the record. If it malfunctions or gets compromised, rewriting the log is often easier than fixing the bug. A missing bad entry proves nothing, consistent with both nothing bad happening and the entry being erased. This matters as autonomy accelerates. Agents now handle approvals, financial transfers, data access. The permission, guardrail, and audit questions collapse into one: if this agent acted, can you prove it to someone who doesn't trust the system? If your agent processed transactions yesterday and needed to prove each one to a customer, regulator, or court, where would that proof come from? The agent's own logs, or somewhere the agent cannot reach?

Pleased to see LexisNexis® Risk Solutions once again recognized by Juniper Research as an Established Leader in Digital Identity Verification. The Digital Identity Verification Market 2026-2030 report looks at how identity verification is being used more broadly across the customer journey, with layered, risk-led approaches becoming more important. Useful reading for teams thinking about how to strengthen identity checks without adding unnecessary friction. https://bit.ly/4AZv1tP

A Breach Ends Trust At Scale For a firm built on client relationships, what does a data breach really mean? Reply SelfAsses https://lnkd.in/gyMukWyp

Just a heads-up for everyone, and it's a good tip for RCICs to pass on to clients. Survey scams are getting more common, and applicants are often most vulnerable when they're stressed about a pending application.

Don’t fall for a fake survey. IRCC routinely collects feedback from clients to improve our services. Your participation in surveys is voluntary. Your responses will be kept confidential and what you tell us won’t affect any past, current or future applications. We will not ask you for: • money • your financial information, like your bank account or credit card details • personal information, such as your date of birth, passwords or passport number If you received an email asking you to complete a survey that you think looks suspicious, do not click on any links and delete the email. To find out if an IRCC survey is legitimate, you can view our list of active surveys here: https://bit.ly/4xkz28V Learn more about how to recognize and protect yourself from email scams: https://bit.ly/3U7D9nV

What surprised me most is that you don't have to overshare to end up on these sites. Much of it comes from public records you never thought about, stitched together into a single profile. Removing yourself once isn't the end of it. These databases refresh from their sources, so profiles often reappear, and every site has its own opt-out process. That's why Cloaked doesn't stop at the data removal. Cloaked finds the personal details already exposed on people-search sites and data broker lists, gets them removed, and keeps watching so they don't quietly reappear. Users also get masked phone numbers and email addresses to use for new accounts, forms, and sign-ups, so everyday life doesn't create new exposure. Check your exposure for free: https://lnkd.in/gw9yttZp