In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Supervisory Authorities & EnforcementThe Challenge Between July 2018 and April 2020, Xandr processed personal data revealing the sexual orientation of Grindr users in Norway without confirming it had a lawful basis to do so. The Norwegia
Supervisory Authorities & EnforcementYou re an ad tech company. A publisher sends you bid requests containing user identifiers and behavioral signals. The publisher claims it has consent. Do you process that data based on their word, or
Security & Breach NotificationWhat happened On October 5, Denmark s government confirmed unauthorized access to the Central Register of Persons (CPR), a national database with records for about 11 million people, including decease
Security & Breach NotificationWhen Daiichi Kosho discovered a malware infection at Nippon Columbia Group had potentially exposed 8,724,000 customer records, the company faced a scenario most privacy teams dread: your data protecti
Get weekly security insights and compliance updates delivered to your inbox.
Security & Breach NotificationWhen Oracle Health reported that its Cerner breach affected 20 million people, many data governance teams dismissed it as a processor issue. But if you re managing an acquisition, a cloud migration, o
Security & Breach NotificationThe Conventional Wisdom When 8.8 million CPR records in Denmark were accessed without authorization, the immediate response was predictable: tighten third-party access controls. Conduct more processor
Lawful Basis for ProcessingThe question at hand You ve stripped out names, replaced identifiers with random codes, and removed postcodes. Your processor assures you the dataset is anonymous. Your legal team signed off. But can
Security & Breach NotificationWhen ASOS customers received alarming ASOS HACKED alerts on their phones, the issue wasn t a typical hack. Attackers had breached third-party platforms used for customer communications, turning ASOS s
Security & Breach NotificationA private company s compromised access to Denmark s Central Population Register exposed 8.8 million records in September 2024. This breach affected more people than Denmark s entire living population
Security & Breach NotificationWhat Happened Unauthorized parties accessed Denmark s Central Person Register through a small Danish company s legitimate account over a 10-day period in September. This breach exposed names, addresse
Security & Breach NotificationThe Challenge Your organization reports a personal data breach to the CNIL . You ve met the 72-hour notification requirement under Article 33, informed affected individuals, and documented your incide
Security & Breach NotificationWhen the Technical University of Denmark (DTU) revealed that hackers used compromised credentials to access its identity and access management (IAM) system, exposing data on up to 200,000 individuals,
Supervisory Authorities & EnforcementOn September 30, 2025, the UK s data protection supervisory authority transitioned from a single-person leadership to a committee structure. The Information Commission replaced the Information Commiss
Security & Breach NotificationWhen a processor like Fakturownia suffers a personal data breach affecting more than 600,000 businesses, you need a documented response protocol that your team can execute without improvising under pr
Supervisory Authorities & EnforcementThe European Data Protection Board (EDPB) has adopted a five-step method for administrative fines, prompting a critical question for your team: should every GDPR violation result in a financial penalt
Lawful Basis for ProcessingScope of This Guide This guide covers the lawful basis, transparency, and retention requirements for processing location data under the GDPR . It focuses on the violations identified in Google s €403m
Supervisory Authorities & EnforcementYou re collecting location data. The question isn t whether you need a retention policy, it s which retention model fits your processing purposes and risk profile. Ireland s Data Protection Commission
Supervisory Authorities & EnforcementThe Irish Data Protection Commission s €403 million fine against Google for unlawful location data processing isn t just another headline. It s a technical blueprint of what breaks when transparency o
Lawful Basis for ProcessingThe Ireland Data Protection Commission s €403 million fine against Google Ireland Limited wasn t about a data breach or a rogue employee. It was about everyday processing decisions that seemed reasona
Supervisory Authorities & EnforcementThe Irish Data Protection Commission fined Google Ireland Limited €403 million for violating multiple GDPR principles through its location tracking features. If your team processes location data throu
