In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Security & Breach NotificationWhen Daiichi Kosho discovered a malware infection at Nippon Columbia Group had potentially exposed 8,724,000 customer records, the company faced a scenario most privacy teams dread: your data protecti
Security & Breach NotificationThe Conventional Wisdom When 8.8 million CPR records in Denmark were accessed without authorization, the immediate response was predictable: tighten third-party access controls. Conduct more processor
Lawful Basis for ProcessingThe question at hand You ve stripped out names, replaced identifiers with random codes, and removed postcodes. Your processor assures you the dataset is anonymous. Your legal team signed off. But can
Security & Breach NotificationWhen ASOS customers received alarming ASOS HACKED alerts on their phones, the issue wasn t a typical hack. Attackers had breached third-party platforms used for customer communications, turning ASOS s
Get weekly security insights and compliance updates delivered to your inbox.
Security & Breach NotificationA private company s compromised access to Denmark s Central Population Register exposed 8.8 million records in September 2024. This breach affected more people than Denmark s entire living population
Security & Breach NotificationWhen a processor like Fakturownia suffers a personal data breach affecting more than 600,000 businesses, you need a documented response protocol that your team can execute without improvising under pr
Supervisory Authorities & EnforcementYou re collecting location data. The question isn t whether you need a retention policy, it s which retention model fits your processing purposes and risk profile. Ireland s Data Protection Commission
Lawful Basis for ProcessingThe Ireland Data Protection Commission s €403 million fine against Google Ireland Limited wasn t about a data breach or a rogue employee. It was about everyday processing decisions that seemed reasona
Supervisory Authorities & EnforcementThe Irish Data Protection Commission fined Google Ireland Limited €403 million for violating multiple GDPR principles through its location tracking features. If your team processes location data throu
Supervisory Authorities & EnforcementThe Irish Data Protection Commission s €403 million fine against Google for location data processing violations between May 2018 and February 2020 offers a clear view into how supervisory authorities
Data Subject RightsYou re redesigning your privacy notice. Your legal team wants to list a phone number for rights requests. Your customer service team suggests using your existing premium-rate line to handle the volume
Security & Breach NotificationWhat Happened On September 14, Spain s supervisory authority reported the country s first personal data breach executed by an agentic AI system. The AI agent, using a known language model, scanned gen
Security & Breach NotificationAn autonomous AI agent breached a Spanish company s network, altered personal data records, and extracted invoice information. Spain s supervisory authority confirmed it s their first reported inciden
Security & Breach NotificationA New Threat: AI-Driven Cyber Attacks Should your security and data protection models treat AI-driven attacks as a fundamentally different threat category requiring new defensive architectures, or can
Supervisory Authorities & EnforcementThese questions come from a DPO roundtable I attended last month, right after Grindr s £26m settlement hit the news. The room went quiet when someone asked: Could our pre-acquisition data practices tr
Security & Breach NotificationThe Question at Hand A breach involving 153 million driver s licenses has reignited a debate in privacy circles: should large datasets of personal information fall under regulatory frameworks as stric
Security & Breach NotificationIntroduction When 8.7 million customer records are exposed online, as happened with Manchester Airports Group , the damage extends beyond the breach itself. Criminals can exploit names, email addresse
Supervisory Authorities & EnforcementThe first year of GDPR enforcement revealed a harsh truth: most organizations weren t prepared, and many still aren t. Helen Dixon, the Irish Data Protection Commissioner, described that period as a w
Scope & ExemptionsYou re moving personal data outside the EEA. The question isn t whether you need a transfer mechanism, it s which one matches your operational reality and risk tolerance. The decision tree below guide
generalUnderstanding the Guide s Focus This guide decodes the negotiation dynamics behind EU data protection rulemaking and explains how understanding these political mechanics can sharpen your compliance st
