March 2026 Summaries

The recent guidance from the UK's Department for Science, Innovation and Technology (DSIT) marks a significant step forward in secure data collaboration by advocating for the use of Privacy-Enhancing Technologies (PETs) when combining data sources to protect individual privacy. This directive supports the use of advanced techniques such as homomorphic encryption and secure computation, encouraging a shift from relying on trust to technically limiting data exposure, thus enhancing privacy while linking datasets. It aligns with the Information Commissioner’s Office's direction and demonstrates how policy and technology can synergize to promote innovation. The guidance facilitates faster, privacy-preserving data analysis, as evidenced by a collaboration between NHS England’s National Disease Registration Service and the US National Cancer Institute, which used privacy-preserving architectures to conduct research on rare childhood cancer data without transferring sensitive information across borders. This initiative provides a framework that encourages secure, responsible collaboration, allowing organizations to extract more value from distributed data sources efficiently.

Artificial intelligence (AI) is revolutionizing industries by driving innovation and efficiency, but it also introduces complex data security challenges. AI systems require large volumes of sensitive data for model training and operation, making them susceptible to risks such as data poisoning, leakage, and unauthorized access. Effective AI data security involves implementing controls to protect the confidentiality, integrity, and availability of data used in AI systems. It differs from traditional data security by addressing new assets like model artifacts and attack vectors such as model inversion and extraction. Organizations can safeguard sensitive AI data by securing the entire data supply chain, employing privacy-preserving techniques, and ensuring governance and monitoring across the AI lifecycle. Duality Technologies offers solutions to enhance AI data security by using privacy-enhancing technologies, allowing organizations to collaborate and gain insights without compromising data integrity or compliance.

Federated learning has evolved from an academic concept to a critical enterprise tool due to increasing privacy regulations, fragmented data environments, and rising computational costs. It enables multiple parties to collaboratively train or evaluate a shared model without centralizing raw data, employing architectures such as centralized aggregation models, decentralized peer networks, hybrid orchestration layers, and architecture-agnostic frameworks, each with unique trade-offs concerning scalability, privacy, training speed, governance, and infrastructure complexity. Especially beneficial in industries like healthcare, finance, and government, federated learning allows for the creation of AI models that respect data sovereignty and privacy while enhancing model performance through diverse data sets. Critical architectural considerations include orchestrating latency, update compression, and cross-organizational governance, with a focus on ensuring data privacy through secure aggregation, differential privacy, and homomorphic encryption. Companies like Duality offer platforms to facilitate secure federated learning deployments, promoting seamless collaboration across regulated environments without compromising data privacy or compliance.

In 2026, secure data sharing has evolved to focus on controlling data usage rather than merely ensuring safe data movement, driven by the need for collaboration in regulated industries like finance, healthcare, and AI while maintaining control over sensitive data. Traditional models often fail due to their reliance on trust and static security measures, necessitating modern approaches that prioritize policy-driven systems and continuous enforcement. Key strategies include shifting from data movement to controlled access, using Trusted Execution Environments (TEEs) for sensitive processing, applying federated learning for distributed AI training, enforcing fine-grained access control, utilizing data clean rooms for collaboration, implementing homomorphic encryption for encrypted data computation, and enforcing data residency and sovereignty controls. These strategies are layered to address different dimensions of risk, with orchestration ensuring their integration and consistency across systems. Organizations face the choice between building their own infrastructure for maximum control and flexibility or buying platforms for faster deployment, often resulting in a hybrid approach to meet specific regulatory and operational needs.