In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Lawful Basis for ProcessingYou ve published your privacy notice and added a consent banner. You ve ticked the transparency box. But if your users still can t understand what they re agreeing to, you haven t built compliance, yo
Data Subject RightsUnderstanding the Issue The challenge isn t a single incident but a widespread issue affecting organizations using AI. When individuals exercise their Article 17 erasure rights, many organizations str
Controller & Processor RolesEvery week, I get questions about whether a data protection officer (DPO) can juggle multiple roles, especially in IT security. These questions often arise after a new DPO appointment or organizationa
Data Subject RightsThese questions come from conversations with DPOs and in-house counsel over the past year. The UK Supreme Court s decision in ZXC v Bloomberg changed how we think about privacy during criminal investi
Get weekly security insights and compliance updates delivered to your inbox.
Lawful Basis for ProcessingWhy these mistakes keep happening Higher education institutions often rush to adopt collaborative platforms. Your procurement team signs off on a cloud tool, IT rolls it out, and faculty start uploadi
Supervisory Authorities & EnforcementThe U.K. Information Commissioner s Office s Age Appropriate Design Code outlines 15 standards for online services that process children s personal data. If your service is likely to be accessed by ch
Security & Breach NotificationQuestions started landing in my inbox after a Canadian supervisory authority announced its investigation into Human Resources and Skills Development Canada following a breach affecting student loan re
Supervisory Authorities & EnforcementJohn Edwards took office as U.K. Information Commissioner on January 4, 2022, marking a shift in the ICO s approach. If your compliance program treats the ICO as static, you re already behind. Edwards
Supervisory Authorities & EnforcementThe European Data Protection Board (EDPB) publishes guidelines, adopts consistency findings, and issues opinions. Your team reads them, implements them, and assumes you re aligned with supervisory aut
Supervisory Authorities & EnforcementScope - What This Guide Covers This guide focuses on the new requirement for UK controllers to establish formal data protection complaint handling processes under section 164A of the Data Protection A
generalThe European Commission s November 19 omnibus packages introduced two proposals that will reshape your approach to AI compliance. One targets the GDPR , while the other proposes delaying regulation of
Supervisory Authorities & EnforcementThe EDPB adopted a standardized DPIA template on 10 March 2026, followed by a common breach notification template on 8 June. Both stemmed from the Helsinki Statement, the EDPB s July 2025 commitment t
Supervisory Authorities & EnforcementThe recent EDPB plenary introduced new guidelines that could reshape how you handle anonymisation, web scraping, and blockchain. If you re responsible for data privacy, you re likely wondering how the
Supervisory Authorities & EnforcementThese questions stem from a conversation with a Data Protection Officer (DPO) after the ICO reprimanded the Criminal Records Office. The breach affected over 10,000 people, exposing biometric data and
Security & Breach NotificationWhen Manchester Airports Group discovered unauthorized access to customer data from three UK airports, they followed the standard protocol: contain the risk, notify authorities, and contact affected c
Supervisory Authorities & EnforcementAn automated system flags a driver s account for low ratings. Within seconds, the account locks. No human reviews the context, no one considers mitigating factors, and the driver s income stops. The D
Security & Breach NotificationThe Problem: Why This Matters Now Your incident response plan might be tucked away in a SharePoint folder, labeled something like IR_Plan_v3_FINAL_updated.docx . When Manchester Airports Group faced a
Security & Breach NotificationWhen ShinyHunters dumped what it claimed was 50GB of Carhartt customer data in August, the headline number looked catastrophic: twenty-five million email addresses. Except it wasn t true. Troy Hunt s
Supervisory Authorities & EnforcementYour force just approved a live facial recognition trial, believing it ll speed up crime detection. Now, your inbox is flooded with questions, and the ICO s latest audit findings aren t helping. These
Supervisory Authorities & EnforcementThe Challenge of Compliance When the EDPB adopted Guidelines 02/2025 on July 7, 2026, it addressed a key issue: can an immutable ledger comply with a regulation that requires data deletion? For your t
