Data Protection, AI and Professional Service Firms: 2026 Privacy Developments

The AI revolution has increased the privacy stakes for professional service firms as they evolve their work processes, use powerful large language models (LLMs) to churn through terabytes of information and integrate AI agents into their workforce. Underpinning these phenomena is easy access to data which heightens the importance of data protection.

GDPR Turns Eight

On May 25, 2026, the EU’s General Data Protection Regulation (GDPR) turned eight years old.

Following its enactment in May 2018, European data protection regulators have imposed billions of euros in fines, led by Ireland’s Data Protection Commission (DPC) which has levied over €4 billion.

Key trends relating to GDPR enforcement:

• Most active regulators. As of October 2026, 8 out of the 10 largest GDPR fines have been imposed by Ireland’s DPC against Big Tech companies, including a record €1.2 billion fine.
  • Netherlands (€1,278M) and France (€894M) are second and third respectively.
    
    
• Violation type. Some of the larger GDPR fines have been imposed for lack of transparency or deficient security in the collection or processing of consumer data and unlawful data transfers from the EU to the U.S.

Your Honor, I Object!

• WhatsApp appeal moves forward. In February 2026, the Court of Justice of the European Union (CJEU) ruled that an appeal against a €225 million fine imposed against WhatsApp Ireland could move forward. The court ruled that the European Data Protection Board’s (EDPB) decision is “an act open to challenge before the Courts of the European Union”. The decision could have wider implications in legal challenges to GDPR fines, potentially opening the door to an appeal of the record €1.2 billion imposed against Meta Platforms in 2023 by Ireland’s DPC.
  
  
• Record Amazon fine overturned. A €746 million GDPR fine against Amazon was annulled by the Administrative Court of Luxembourg in March 2026. The €746 million penalty was imposed by the National Commission for Data Protection (CNPD) in July 2021 in relation to online behavioral advertising practices; the largest GDPR fine up to that time. The court ruled that the CNPD’s enforcement process was deficient in two major ways: failing to evaluate the negligent or intentional nature of the violation and neglecting to consider the possibility of a more lenient penalty. The case was referred back to the CNPD.

Timeline of Notable GDPR Fines and Developments | 2024-2026

Cyber Risk Still Top-of-Mind

Consulting Firms Continue to Face Costly Data Breaches

Clorox Data Breach Lawsuit. Clorox filed a US$380 million lawsuit against a large information technology services provider in July 2025, alleging that the IT company enabled a “catastrophic” August 2023 cyberattack.

• The IT company’s service desk agents allegedly provided login credentials to the Clorox network without proper authentication.
• The attack paralyzed Clorox’s corporate network and severely disrupted business operations.
• In March 2026, a California judge dismissed a claim for intentional misrepresentation with leave to amend, while allowing other claims to move forward.

PowerSchool Data Breach. A management consulting firm is facing litigation related to a data breach involving its portfolio company, PowerSchool Holdings Inc. (PowerSchool), an education software provider.

• Plaintiffs include individuals, such as employees and students, and school districts and other institutions that used PowerSchool software.
  
  
• The data breach began in August 2024 when a cybercriminal group known as “ShinyHunters” accessed PowerSchool’s system and began exfiltrating data. The data breach was detected by PowerSchool in December 2024, when a ransom payment was demanded. The breach was publicly disclosed in January 2025.

U.S. Legislative Landscape – Data Privacy

SECURE Data Act. In April 2026, U.S. House Republicans tabled the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Data Act).

• The bill represents a fresh attempt to replace the patchwork of 20+ state privacy laws.
  
  
• The SECURE Data Act contains no private right of action, with the U.S. Federal Trade Commission (FTC) and state AGs ensuring enforcement.

CCPA Enforcement. In May 2026, the California Privacy Protection Agency (CalPrivacy) announced its largest ever fine under the California Consumer Privacy Act (CCPA) against General Motors.

• GM agreed to a US$12.75 million settlement following an investigation into the car manufacturer’s data collection practices, particularly its OnStar Smart Driver connected vehicle services.
  
  
• Geolocation data, including driving behavior data and other personally identifiable information were sold to data brokers without obtaining proper consent.

Supreme Court ruling casts doubt on future of EU-US Framework. Following the Supreme Court’s June 2026 ruling in Trump v. Slaughter, there are concerns that the adequacy standing of the U.S. may be reassessed or possibly revoked.

• Slaughter centered on the dismissal of the FTC Commissioner that was ultimately judged lawful by the Supreme Court, strengthening presidential control over independent federal agencies.
  
  
• The European Data Protection Board has requested the European Commission to reassess the EU-U.S. Data Privacy Framework following the Supreme Court’s ruling. Data transfers between the EU and the U.S. depend upon this framework.

The Professional Services Practice at Aon will continue to monitor developments related to data privacy and cybersecurity, particularly with relation to professional service firms, and related matters.

About Aon

Aon (NYSE: AON) exists to shape decisions for the better — to protect and enrich the lives of people around the world. Through actionable analytic insight, globally integrated Risk Capital and Human Capital expertise, and locally relevant solutions, our colleagues provide clients in over 120 countries with the clarity and confidence to make better risk and people decisions that help protect and grow their businesses.

Follow Aon on LinkedIn, X, Facebook and Instagram. Stay up-to-date by visiting Aon’s newsroom and sign up for news alerts here.

©2026 Aon plc. All rights reserved.

Aon is not a law firm or accounting firm and does not provide legal, financial or tax advice. Any commentary provided is based solely on Aon’s experience as insurance practitioners. We recommend that you consult with your own legal, financial and/or insurance advisors on any commentary provided herein. All descriptions, summaries or highlights of coverage described herein are for general informational purposes only and do not amend, alter or modify the actual terms and conditions of any relevant policy. Coverage is governed only by the terms and conditions of such policy. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details.

The information contained in this document and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity.

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates.