How NCR Voyix handles a sub-brand or domain that goes rogue

Summary An acquired site keeps firing undocumented analytics and ad tech tags for a year, still sells user data under the old company's privacy policy, and drops third-party cookies on a domain CNAMEd to the parent. Then a regulator's letter arrives, addressed to the parent. Luiz Santos, Senior Managing Counsel - Global Privacy & DPO at NCR Voyix, joins host Ethan Prete to walk through what to do when a sub-brand or domain goes rogue. Luiz explains why ownership doesn't mean control, why shared responsibility so often becomes no responsibility, how one standard across every domain keeps sub-brands in line, what regulators expect when you get it wrong, and how he fixed a broken Global Privacy Control setup with marketing in under a month on zero budget. He also covers his role as Brazil DPO and how LGPD compares with GDPR. Essential listening for privacy, legal and marketing leaders responsible for more than one website. The views and opinions expressed belong to Luiz and do not necessarily reflect the views, positions, or policies of NCR Voyix, nor do they constitute legal advice. Chapters 00:00 Cold open: why every domain needs a framework 00:47 Intro 01:31 Meet Luiz Santos and NCR Voyix 03:39 How the privacy team is structured 05:10 LGPD and Brazil's copy of GDPR 07:37 How regulators pick their targets 10:15 The scenario: an acquired domain goes rogue 14:40 Whose responsibility is it? 18:27 One standard across sub-brands and domains 20:19 Mapping your true risk tolerance 21:37 Personalization vs privacy 23:33 Do regulators have empathy? 26:21 Remediation as a partnership 31:43 Where to find Luiz Takeaways - Acquiring a company or launching a sub-brand means owning everything its domains do, for better or for worse; ownership doesn't mean control. - Privacy due diligence starts with a complete list of domains and an owner for each, and most companies cannot produce one. - Shared responsibility often becomes no responsibility unless one standard and one framework apply to every domain and sub-brand. - Regulators show empathy to companies that can tell a good story with evidence, and public-facing gaps are the easiest to prove. - Privacy fixes move fastest when legal partners with marketing; Luiz fixed a broken GPC setup in under a month with zero budget. Connect with the Guest Luiz Santos LinkedIn: https://www.linkedin.com/in/luiz-santos-143796205 Company Website: https://www.ncrvoyix.com Luiz is a speaker at the GA BAR 2026 Privacy and Technology Law Forum and at Consero's 2026 Chief Privacy Officer Forum. Sponsor Brought to you by ObservePoint, the web governance platform that helps the world's largest enterprises see exactly what their websites are doing, and prove it. Learn more about your website here: https://www.observepoint.com/