In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Supervisory Authorities & EnforcementYou re collecting location data. The question isn t whether you need a retention policy, it s which retention model fits your processing purposes and risk profile. Ireland s Data Protection Commission
Supervisory Authorities & EnforcementThe Irish Data Protection Commission fined Google Ireland Limited €403 million for violating multiple GDPR principles through its location tracking features. If your team processes location data throu
Supervisory Authorities & EnforcementThe Irish Data Protection Commission s €403 million fine against Google for location data processing violations between May 2018 and February 2020 offers a clear view into how supervisory authorities
Supervisory Authorities & EnforcementThese questions come from a DPO roundtable I attended last month, right after Grindr s £26m settlement hit the news. The room went quiet when someone asked: Could our pre-acquisition data practices tr
Get weekly security insights and compliance updates delivered to your inbox.
Supervisory Authorities & EnforcementThe first year of GDPR enforcement revealed a harsh truth: most organizations weren t prepared, and many still aren t. Helen Dixon, the Irish Data Protection Commissioner, described that period as a w
Supervisory Authorities & EnforcementThe U.K. Information Commissioner s Office s Age Appropriate Design Code outlines 15 standards for online services that process children s personal data. If your service is likely to be accessed by ch
Supervisory Authorities & EnforcementJohn Edwards took office as U.K. Information Commissioner on January 4, 2022, marking a shift in the ICO s approach. If your compliance program treats the ICO as static, you re already behind. Edwards
Supervisory Authorities & EnforcementThe European Data Protection Board (EDPB) publishes guidelines, adopts consistency findings, and issues opinions. Your team reads them, implements them, and assumes you re aligned with supervisory aut
Supervisory Authorities & EnforcementScope - What This Guide Covers This guide focuses on the new requirement for UK controllers to establish formal data protection complaint handling processes under section 164A of the Data Protection A
Supervisory Authorities & EnforcementThe EDPB adopted a standardized DPIA template on 10 March 2026, followed by a common breach notification template on 8 June. Both stemmed from the Helsinki Statement, the EDPB s July 2025 commitment t
Supervisory Authorities & EnforcementThe recent EDPB plenary introduced new guidelines that could reshape how you handle anonymisation, web scraping, and blockchain. If you re responsible for data privacy, you re likely wondering how the
Supervisory Authorities & EnforcementThese questions stem from a conversation with a Data Protection Officer (DPO) after the ICO reprimanded the Criminal Records Office. The breach affected over 10,000 people, exposing biometric data and
Supervisory Authorities & EnforcementAn automated system flags a driver s account for low ratings. Within seconds, the account locks. No human reviews the context, no one considers mitigating factors, and the driver s income stops. The D
Supervisory Authorities & EnforcementYour force just approved a live facial recognition trial, believing it ll speed up crime detection. Now, your inbox is flooded with questions, and the ICO s latest audit findings aren t helping. These
Supervisory Authorities & EnforcementThe Challenge of Compliance When the EDPB adopted Guidelines 02/2025 on July 7, 2026, it addressed a key issue: can an immutable ledger comply with a regulation that requires data deletion? For your t
Supervisory Authorities & EnforcementWhen a complaint involves multiple regulators, such as GDPR intersecting with consumer protection or financial services oversight, you face a coordination challenge. The EDPB has called for clearer le
Supervisory Authorities & EnforcementThe challenge isn t whether you can rely on legitimate interests for AI web scraping. It s that many teams treat the legitimate interests assessment like a checkbox exercise rather than a defensible c
Supervisory Authorities & EnforcementWhat happens when you scrape 20 years of internet data to train a generative AI model and then discover you can t identify a lawful basis that holds up under scrutiny? This isn t hypothetical. The Eur
Supervisory Authorities & EnforcementThe European Data Protection Board (EDPB) published draft Guidelines 02/2026 on Anonymisation on 7 July 2026, and they re not a gentle update. If you ve been treating anonymisation as a one-time techn
Supervisory Authorities & EnforcementThe EDPB recently released draft Guidelines 02/2026 on Anonymisation for public consultation. Since then, I ve been hearing the same questions from DPOs and privacy leads trying to understand the impa
