Regulatory
- 🆕 NEW - California DFPI enters consent order with mortgage lender over alleged excessive per diem interest and documentation lapses - 🔗 JD Supra
- 💡 On October 30, the California DFPI entered into a consent order with a mortgage lender and servicer after a regulatory examination into the company surfaced multiple alleged violations of the California Residential Mortgage Lending Act (CRMLA). The examination revealed that, in two out of nine loans reviewed, the company purportedly charged borrowers per diem interest for more than one day prior to loan proceeds being disbursed from escrow in violation of the….
- 🆕 NEW - FTC Clears Publicis-LiveRamp Deal: Five-Year Data Firewall Protects Rivals for Now - 🔗 Tech Times
- 💡 On October 21, the FTC voted 2–0 to approve Publicis Groupe’s $2.2 billion acquisition of LiveRamp, subject to five-year data-access and firewall conditions. The order makes nondiscriminatory access and separation of customer data central governance controls, but those protections expire after five years. This week, data governance and privacy teams should assess controls for third-party data access and watch for the FTC’s final consent order and sunset provisions.
- 🆕 NEW - 20262388: Softcat plc; H.I.G. Middle Market LBO Fund III, L.P. - 🔗 Federal Trade Commission (.gov)
- 💡 On October 22, 2026, the FTC recorded a granted status for transaction 20262388, in which Softcat plc is acquiring H.I.G. Middle Market LBO Fund III, L.P.’s GDT Topco, L.P. Data governance teams may need to track ownership and control changes affecting data held by or shared with GDT Topco as the transaction proceeds. This week, have M&A and data governance leads confirm the transaction’s status and identify any GDT Topco data assets, systems, or third-party arrangements requiring review.
Industry
- 🆕 NEW - AI Adoption Outpaces Enterprise Governance, Raising Data Security Concerns - 🔗 CDO Magazine
- 💡 On October 21, monday.com’s 2026 AI report, based on a Nielsen survey of 1,701 directors and senior managers, found that 96% of respondents use AI at work while only 29% said AI was fully integrated into a centralized operating system. The survey also found that 46% worried about losing control over AI agents’ actions and 52% were concerned about agents accessing data without sufficient restrictions. This week, data governance teams should inventory which AI agents can access enterprise data, what actions they can take, and whether permissions and audit logs cover those agents.
- 🆕 NEW - Federal Agencies Adopt Agentic AI as Governance Gaps Persist - 🔗 CDO Magazine
- 💡 CDO Magazine reported on The Agentic Future, a survey of 100 federal IT decision-makers: 45% of respondents’ agencies already use agentic AI in at least one production or operational workflow, and another 34% are exploring or piloting it. Only 35% said their agencies have defined human-in-the-loop review, 34% have clarified decision authority, and 33% have trained employees to work with AI agents. This week, map agent access, approval thresholds, and accountability before agents coordinate work across systems.
- 🆕 NEW - TDWI Snapshot | The State of Data and AI Governance - 🔗 TDWI
- 💡 On October 26, 2026, TDWI published a snapshot on data and AI governance based on VP of Research Fern Halper’s webinar conversation with ZoomInfo Senior Director of Data Advisory Joseph Santos. The snapshot highlights how diverse inputs, data transformations, and agentic AI actions expand governance beyond source data to access, use, metadata, and context. This week, map one AI use case’s data sources, transformations, access permissions, and permitted actions to identify governance gaps before autonomous use.
Discourse
- 🆕 NEW - Anti-Circumvention Laws Raise the Cost of Knowledge - 🔗 Eff Deeplinks
- 💡 In an October 26, 2026, EFF post, Mitch Stoltz criticized Reddit’s Section 1201 lawsuit against SerpAPI and Perplexity over access to Reddit content via Google search results. For data governance teams, the case highlights how platform access controls and anti-circumvention law can constrain public-web research and automated data collection. This week, review web-data collection workflows for reliance on third-party search tools and flag access methods that may conflict with platform controls or pending litigation.
- 🆕 NEW - Lessons Learned From 'AdFection' and What To Do Next - 🔗 Eff Deeplinks
- 💡 On October 26, 2026, EFF authors reported that Citizen Lab had uncovered AdFection, a zero-click spyware campaign targeting journalists through ads delivered to their devices. The campaign shows how behavioral advertising infrastructure and third-party ad delivery can become an attack path, complicating privacy, vendor-risk, and security governance. This week, review ad-tech and app dependencies, confirm controls for malvertising and endpoint compromise, and prioritize protections for journalists and other high-risk staff.
Tools & Vendors
- 🆕 NEW - meshIQ and Treehouse Software Enter Partnership for Mainframe Data Delivery - 🔗 Dbta Articles Rss
- 💡 meshIQ and Treehouse Software have partnered to combine Treehouse Dataflow Toolkit with meshIQ’s Kafka management for delivering mainframe data to Snowflake and AWS analytics environments. Automated CDC, bulk loading, schema creation, and streaming monitoring affect how governance teams validate data quality, history, access, and accountability across legacy-to-cloud pipelines. This week, identify any planned TDT deployments and confirm owners, schema and history-table controls, access rules, and monitoring procedures for the affected data flows.
- 🆕 NEW - Zadara Granted NVIDIA AI Cloud Ready Validation Status - 🔗 Dbta Articles Rss
- 💡 DBTA reported that Zadara announced NVIDIA AI Cloud Ready ISV Initiative validated partner status under the NVIDIA Cloud Partner program, covering compute, networking, data platform, storage, and GPU management with NVIDIA’s accelerated computing platform. Zadara said the validation supports multi-tenant isolation across compute, network, and data platform rather than namespace isolation alone. This week, if you are evaluating sovereign or multi-tenant AI cloud vendors, ask how tenant isolation is enforced for training, inference, and agentic workloads.
This week ahead
- This week’s pattern is a widening gap between how quickly data is reused, connected, and put to work—especially for AI—and how reliably organizations can control it. Regulatory scrutiny, concerns about open-web access and adtech abuse, and persistent governance gaps all point to the same issue: data boundaries must hold across the full lifecycle, including disposal, sharing, and new uses.
- In the days ahead, map and stress-test the data paths feeding AI and third parties, prioritizing sensitive data and legacy-to-cloud pipelines. For each path, verify permitted purpose, access limits, retention and deletion, and monitoring; close any gaps before expanding use.
Accuracy check: 10 links checked; implication sentence-1 grounding: 6 passed, 1 failed, 3 uncertain.
Note: A few implication lines did not pass automated source grounding; verify important claims against the articles linked above.