Emtel demonstrates a consistent and sustained improvement in privacy performance, increasing from approximately 38% in 2023 to 44% in 2024 and reaching 56% in 2025. This upward trajectory reflects a structured and deliberate approach to strengthening privacy and data protection practices, rather than isolated or reactive interventions. The progression indicates that privacy controls are increasingly embedded within organisational processes and decision-making frameworks. The 2024 assessment correctly identified Emtel as improving but not yet fully aligned with higher international privacy standards. The 2025 results confirm that these gaps are being actively addressed, positioning Emtel as the most mature organisation among its peers in terms of privacy governance.

From a lawfulness, fairness, and transparency perspective, Emtel's steady improvement suggests increasing maturity in lawful processing mechanisms, clearer and more consistent privacy notices, and more robust management of consent and customer communications across the organisation. With regard to data security and integrity, the sustained upward trend points to the ongoing strengthening of technical and organisational safeguards, supported by improved risk management practices and incident preparedness. The absence of significant performance volatility indicates that security controls are not only implemented but also effectively maintained and periodically reviewed. Emtel's performance also reflects strong accountability and governance, evidenced by consistent year-on-year improvement, defined roles and responsibilities, and clear management ownership of privacy risks. Furthermore, the results indicate growing alignment with privacy by design and default, with privacy considerations increasingly integrated into system development, service design, and operational processes.

MyT's privacy performance exhibits volatility over the assessment period, followed by a marked improvement in 2025. After a marginal decline from approximately 29.3% in 2023 to 28.0% in 2024, the organisation recorded a significant increase to 49% in 2025. The decline observed in 2024 highlighted challenges in maintaining momentum in privacy compliance and keeping pace with evolving regulatory and operational demands. The sharp rebound in 2025 indicates that corrective actions were implemented in response to identified weaknesses. While this improvement is notable, the abrupt nature of the increase suggests a remediation-driven approach rather than a sustained, incremental maturity model. As such, MyT's privacy posture has improved substantially, but its long-term sustainability remains dependent on continued governance, monitoring, and institutionalisation of controls.

From a lawfulness, fairness, and transparency perspective, the 2024 decline points to earlier difficulties in maintaining compliant processing practices and adapting to regulatory change. The improvement in 2025 suggests corrective measures, including updates to privacy notices, processing records, and consent management mechanisms; however, the scale and speed of progress indicate that consistent application across all operations may still be maturing. In relation to data security and integrity, the 2025 performance increase reflects accelerated strengthening of technical and organisational safeguards, potentially through enhanced controls, policies, and monitoring capabilities. While these measures reduce immediate risk exposure, their reactive implementation underscores the need for sustained investment and ongoing effectiveness testing. With respect to accountability and governance, MyT appears to be transitioning toward stronger ownership of privacy risks. Nevertheless, year-on-year performance volatility indicates that governance structures, assurance processes, and management oversight are not yet fully embedded. Alignment with privacy by design and default is improving, but privacy considerations may still be applied retrospectively rather than being consistently integrated into the design of new systems, products, and initiatives.

Liquid Telecom demonstrates a moderate level of privacy capability followed by a decline in performance in 2025, decreasing from approximately 40% in 2024 to 36% in 2025. While earlier results indicated a reasonable baseline, the downward trend suggests growing challenges in sustaining and evolving existing privacy and data protection controls in line with increasing operational complexity and regulatory expectations. This pattern indicates the potential emergence of privacy debt, whereby controls exist but are not sufficiently updated, resourced, or consistently enforced. Without targeted intervention, this decline is likely to translate into elevated compliance and operational risk.

From a lawfulness, fairness, and transparency perspective, the decline may reflect difficulties in maintaining alignment between processing activities, contractual arrangements, and applicable regulatory requirements as the organisation's operations evolve. This increases the risk of inconsistencies in how personal data is processed and communicated to data subjects. In terms of data security and integrity, the reduction in performance points to potential gaps in the maintenance, testing, and periodic review of technical and organisational safeguards. While security controls may be in place, the trend suggests that they may not be keeping pace with changes in systems, data volumes, or the evolving threat landscape. With respect to accountability and governance, the downward trajectory indicates possible weaknesses in oversight, clarity of roles and responsibilities, and prioritisation of privacy risk management. Alignment with privacy by design and default also appears to be weakening, particularly where privacy considerations are not systematically incorporated into system upgrades, process changes, or service expansions.

Atcomm's privacy performance remains consistently low, with no measurable improvement between 2024 and 2025, both recorded at approximately 5%. This sustained stagnation indicates minimal progress in developing or implementing privacy and data protection measures and reflects a very low level of privacy maturity. Compared to industry peers, Atcomm remains at an early stage of privacy capability, exposing the organisation to significant regulatory, operational, and reputational risks.

From a lawfulness, fairness, and transparency perspective, the lack of improvement suggests insufficient formalisation of lawful processing bases, limited or unclear privacy notices, and weak mechanisms for communicating with data subjects. In relation to data security and integrity, the persistently low performance strongly indicates inadequate technical and organisational safeguards, significantly increasing the likelihood of data breaches, data loss, or unauthorised access. Atcomm also demonstrates limited alignment with accountability and governance principles, with little evidence of defined roles and responsibilities, management oversight, or structured privacy risk management. Furthermore, there is minimal indication of privacy by design and default, with privacy considerations unlikely to be embedded into system development, operational processes, or service delivery.

In sum, performance over the years demonstrates that sustained improvement and principle-based governance are key determinants of privacy maturity. Emtel shows strong and consistent alignment with core privacy principles, MyT has made notable but reactive gains, Liquid Telecom exhibits early signs of control erosion, and Atcomm remains significantly exposed. These trajectories provide a clear basis for prioritising risk mitigation efforts and regulatory engagement heading into 2026.