What’s Next in Privacy: 2025 Trends Shaping the Future

Daniel Barber CEO, DataGrail

Privacy is being shaped by evolving laws, advancing technology, and rising consumer expectations. In this forward-looking session, Daniel Barber, CEO of DataGrail, will highlight the key trends set to define 2025 and beyond. You will gain clarity on what’s changing, what it means for their business, and how to stay ahead in a rapidly shifting landscape.

Presentation slides

View Transcript

Well, hopefully folks enjoyed the tunes.
Uh, we, uh, we'll get back into sessions now,
and so, um, I'm going to steer us
for the next few minutes here
and sort of talk through, um, where privacy is headed.
Um, obviously appreciate Tom's guidance on,
on California's position, uh,
but wanted to just kind of give a bit of a backdrop.
Um, we've been obviously in the market since late 2018
and, uh, you know, a lot has changed.
Um, I think privacy really did start with a EU directive.
Um, folks might remember that one,
or maybe it goes back a little bit too far,
but 1995, the, um, EU data protection directive.
This was sort of one of the, the earliest piece
of legislation that that was put into practice.
Um, I think, you know,
obviously the GDPR was a watershed moment, uh,
and we did see enforcement of, of large businesses,
small businesses, but a lot of focus on big tech.
Uh, and I think, um, that made sense given, uh,
at the same sort of period.
Um, we saw Cambridge Analytica, um,
and I think consumers across the US
and globally starting to realize just
how their information may have been used
or being used by new technologies,
whether those are on the web or in mobile.
But I think, um, if we sort of take that one step further,
things have really accelerated the last five years.

Key Trends in Privacy

I would say even the conversations that I've had
with privacy leaders, uh, both recent
and, uh, you know, going back into 2021, um,
it really started with, um, the CCPA.
This was the first, you know, fi sort of comprehensive law
for California, as Tom mentioned.
But things followed quite quickly.
And I would say, um, you know,
20 20, 20 21, um, enforcement was a a little slower I,
I think than probably most expected.
Um, but things accelerated into 2023.

Changes in the Privacy Landscape

At the same time, we saw, um, SIP a litigation
and other litigation, um, with the FTC also stepping in,
um, and even class actions taking place as well.
This has really changed the conversation, um,
that we've been having at Data Grail
and I think across the market as well,
in a position towards risk, um, as opposed
to initially it might have been more of a compliance effort
and effort to, you know, ensure that, um,
folks are being transparent,
but really the risk has heightened over the last,
let's call it 12 to 18, even 24 months.
Um, and I think, you know, if we look at where we are now,

Evolving Ownership

You know, 20 plus states we're in to Tom's Point,
a multi-state era in the US, um, it's great
that we have the GDPR in Europe,
but, um, I think in the US it's quite complex for folks.
Um, we see this every day, uh,
and, uh, you know, kind of wanna spend a little bit
of time digging into what that means
and how folks can perhaps think about it as they go forward.
So, um, if we think about the evolution
of ownership within privacy, there's a few things
that I've seen in terms of trends.
Late 2018, it was very clear it was a legal foundation.
People were trying to understand the GDPR,
understand the requirements, um,
and then even going into the CCPA,
it was very clear interpretation
of those requirements was important,
making sure
that folks really understood
what does this mean for the business.

Cross-functional Collaboration

The interlock started to happen with security,
and I think now as we sort of look at what the,
the cross-functional council looks like,
it's very different than where we began.
Um, the best in class programs
that I see really have legal security
and privacy working together.
Um, and this is when, you know,
privacy is actually implemented across the business,
not just on the privacy policy, um,
but this is an evolution.

Understanding Impact

So why is this happening?
Um, I think there's a couple things going on.
Um, historically, the financial impact, um,
many businesses came to us in, in 20 18, 20 19, even 2020,
sort of suggesting, well, you know,
we don't have a significant presence in Europe,
so maybe the GDPR mostly doesn't apply to us.

Rising Accountability

Things changed with California that led to, you know,
any business that was large enough
and had an online presence, um,
the potential
for financial impact became quite real.
Um, and I would say the remediation, um, expense, whether
that be from litigation
or from enforcement, really started to,
to ramp up 20 23, 20 24.

Reputational Concerns

At this point, um, you know, I think privacy is following
the track that cybersecurity has.

Future Projections

So as we look at the market,
there's some interesting things going on.

Compliance Market

I think, you know, the, there's sort of four markets
that I would say are related and converging.
First is the area of compliance. It's very clear.
Um, there are major players in this market, um,
things like SOC two, um, iso these types
of certifications are critical for most businesses,
particularly those that are B2B.

Data Security Trends

And, you know, vendors like Vanta have taken a leadership position there.
Um, and obviously we work with them, them quite closely.
Um, I think similarly what's happening in data security, um,
particularly in DSPM, um, vendors,
and I should say businesses really are looking for
best in class security in terms of how
to protect the data they have in their business.

Integration Networks

This is all built on an integration network,
so the largest integration network in the industry.
Um, and that foundation really is set at the identity level.

Shift in Responsible Parties

Um, this is really in terms
of legal initiating the conversation when regulations were,
um, fresh and in, in effect,
that was really the 20 20, 20 21 period.
Um, these days, I would say we're involved
with a large number of customers where the CISO
or the security organization is driving the conversation.

Upcoming Audit Requirements

Tom discussed many things today,
but I wanted to kind of point out this, um,
focus on privacy audits.
Um, these are, uh, new,
they will go into effect in January 1st, 2026.
Um, this is really a, a quite a significant shift.

Convergence of State Regulations

And I think this is a transition towards
really board level conversation, board oversight, um,
specifically related to accountability.

Future States Landscape

I get asked this question on almost every call.
Um, and this is a crazy statement,
but I, I think that it would not be unrealistic for us
to expect 40 states in the US
with different state regulations in 2027.

Opportunities and Challenges Ahead

On the other side of things, I think there's a lot of,
of opportunity in terms of AI agents,
but there's also, um, some challenges that will exist.

Um, so on that, on this note, I'll pause.
Um, and I would say very excited
for the session we have ahead.