Keeping past customer data “just in case” is no longer a neutral business choice—it’s increasingly treated as a security and compliance amplifier when things go wrong. France’s CNIL announcement on January 13, 2026, proves it: €27 million against FREE MOBILE and €15 million against FREE, totaling €42 million, tied to a 2024 breach exposing data from 24 million subscriber contracts (including IBANs). ​ The Findings CNIL’s own sanction decision is unambiguous about the retentio

The New York Department of Financial Services (NYDFS) has made it clear through both regulation and enforcement that organizations cannot manage, secure, or certify what they cannot see. Asset inventories and documented retention practices are no longer administrative exercises — they are foundational components of cybersecurity governance, executive accountability, and regulatory trust. Recent NYDFS consent orders demonstrate that these expectations are not theoretical. Most

Why Leaders Must Act Now to Strengthen Their Information Governance Foundations For years, organizations have watched unstructured information grow quietly in the background—emails piling up, Teams chats exploding, shared drives multiplying, and documents scattered across cloud platforms. Everyone knew it was messy. Everyone assumed they’d clean it up “one day.” That day has now arrived. 2026 is shaping up to be the year poor information management stops being an operational

For years, governance professionals like myself have been preaching a simple truth: technology is no longer just an operational tool —...