Before most CruiseCon attendees had eaten breakfast Sunday morning, their personal data had probably crossed more international borders than they had.
That was the starting point for Adriana Antunes Winkler, global privacy lead at Accenture, during her presentation at the CruiseCon Privacy & AI 2026 event aboard Mariner of the Seas.
Phones connected to networks. Email synchronized. Payment transactions cleared. Wearables potentially uploaded health information. Meanwhile, vendors, sub-processors, cloud providers and AI platforms could be processing that data in locations users — and perhaps their employers — could not readily identify.
Winkler asked attendees a deceptively difficult question: Can you name every country where your organization's personal data is processed, including the locations used by vendors, sub-processors and AI providers?
No one in the audience raised their hand.
That gets to the fundamental problem confronting global privacy programs: Technology is global, instantaneous and distributed. Regulation remains territorial, jurisdictional and comparatively slow to change.
Privacy is global. Compliance is still local.
Privacy regulation has become the norm rather than the exception.
Winkler's presentation cited IAPP research showing 179 of 240 jurisdictions analyzed now have data protection frameworks, covering more than 6.6 billion people — roughly 80% of the world's population. But those laws do not form a single global privacy regime.
The European Union and Brazil lean heavily toward privacy as a fundamental right. The United States relies on a mixture of state consumer-privacy laws and sector-specific requirements. China's framework emphasizes security and sovereignty. Singapore and other Asia-Pacific jurisdictions tend toward accountability-oriented approaches designed to protect data while enabling business.
The terminology can sound similar — consent, sensitive data, profiling, accountability — while the legal meaning and operational requirements vary significantly from one jurisdiction to another.
Winkler offered children's privacy as an example. The threshold below which parental consent is generally required for online data processing is under 13 in the United States under COPPA, under 14 in China under PIPL, 16 by default under GDPR — although EU member states can lower it to 13 — and under 18 in India under the DPDP Act.
“One product. One sign-up screen. Four age gates,” Winkler said.
Stop building a privacy program for every law
The intuitive response is to comply with each privacy law independently. Winkler said that approach eventually collapses under its own weight.
Organizations operating across dozens of jurisdictions can end up with separate policies, processes and tools for Europe, Brazil, the United States, China, Singapore and everywhere else. Policies multiply. Controls conflict. Employees become confused. Compliance becomes reactive.
“Eventually, you don't have a privacy program,” Winkler said.
Her alternative is straightforward:
Global core. Local edge.
Organizations should build common privacy capabilities once — a single data inventory, rights process, risk methodology, vendor framework and privacy-by-design workflow — then introduce local variations only where individual jurisdictions genuinely require them.
Winkler called it “controlled variation.”
That also means organizations should resist another seemingly simple answer: imposing the strictest privacy requirement everywhere.
Some obligations inherently need to remain local, including transfer requirements, localization rules, opt-outs and jurisdiction-specific duties. A global framework should manage what is common globally while identifying, documenting and assigning ownership to the exceptions.
Laws don't run businesses. Controls do.
Winkler, whose work frequently puts her between lawyers, CISOs and security teams, repeatedly returned to the need to translate regulation into something operational.
“Laws don't run businesses,” she said. “Controls do.”
A requirement to “be transparent,” for example, has to become notice management, a process for reviewing and updating notices, supporting technology, evidence such as logs and records, and ultimately a named owner responsible for the control.
The question isn't merely whether a policy exists. It's whether the organization can prove the policy operates.
“If you can't demonstrate it, did it happen?” Winkler asked.
That makes modern privacy governance increasingly similar to cybersecurity governance: controls need owners, controls need testing, and organizations need evidence that those controls actually worked.
Then AI changes the equation again.
AI turns privacy from collection to inference
Traditional privacy programs largely revolve around information organizations collect. AI can create consequential information that an individual never provided.
“Sometimes the most consequential information about a person is information they never gave us,” Winkler said.
A model can infer preference, risk, emotion, intent, likelihood and classifications from other information. That creates a new series of privacy questions: Who owns the input? Where did the training data come from? What does the model remember? What can it infer? Can an individual correct the inference? Can it actually be deleted? And who ultimately remains accountable?
The issue becomes more complicated when AI stops merely generating answers and starts taking actions.
Winkler noted that AI agents still lack a single standalone legal category, but regulators worldwide are already addressing them through existing law, guidance and emerging governance frameworks.
Her practical advice is to follow the action, not the architecture.
Instead of starting by asking what type of AI system an organization has deployed, privacy teams should inventory what the agent actually does, which data it touches, which systems it can access and which people its actions affect.
Winkler described it succinctly: “It's your data map, with verbs.”
Privacy teams should know who acts as controller when an agent operates, what systems it can reach, what it remembers, whether a human can stop it and whether it identifies itself — and the party on whose behalf it acts.
What happens when the data leaves Earth?
Winkler then pushed the jurisdiction problem to its logical extreme. What happens when the data isn't in another country at all? What happens when it's in orbit?
Her presentation highlighted early orbital-computing projects, including Google's Project Suncatcher prototype and TakeMe2Space's MOI-1A. These remain research and early commercial efforts rather than hyperscale space-based data centers, but they introduce a privacy question that sounds futuristic while becoming increasingly concrete:
If processing happens in orbit, where does it legally occur?
Space isn't lawless. Under the Outer Space Treaty, the state where a space object is registered retains jurisdiction and control over it. But that doesn't automatically answer the privacy question.
Which cross-border transfer requirements apply to personal information processed aboard a satellite? Which regulator supervises the processor? What happens to data-localization obligations? And if an organization eventually stores backups on the Moon, who does a consumer call to demand deletion?
The same governance model organizations need today — common controls, carefully managed jurisdictional differences, clear ownership and demonstrable evidence — will have to follow data wherever technology takes it.
That includes across national borders, through AI systems and agents, and perhaps eventually beyond the atmosphere.
“Global privacy alignment isn't about making every law identical,” Winkler concluded. “It's about building a governance system that manages what is common, isolates what is different, and adapts when the rules change.”
The technology will keep moving. Privacy governance has to move with it.
More CruiseCon coverage:
Bill Brenner
Bill Brenner
Bill Brenner
