In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Supervisory Authorities & EnforcementYou re an ad tech company. A publisher sends you bid requests containing user identifiers and behavioral signals. The publisher claims it has consent. Do you process that data based on their word, or
Security & Breach NotificationThe Challenge Your organization reports a personal data breach to the CNIL . You ve met the 72-hour notification requirement under Article 33, informed affected individuals, and documented your incide
Supervisory Authorities & EnforcementOn September 30, 2025, the UK s data protection supervisory authority transitioned from a single-person leadership to a committee structure. The Information Commission replaced the Information Commiss
Lawful Basis for ProcessingScope of This Guide This guide covers the lawful basis, transparency, and retention requirements for processing location data under the GDPR . It focuses on the violations identified in Google s €403m
Get weekly security insights and compliance updates delivered to your inbox.
Supervisory Authorities & EnforcementThe Irish Data Protection Commission s €403 million fine against Google for unlawful location data processing isn t just another headline. It s a technical blueprint of what breaks when transparency o
Lawful Basis for ProcessingThe Challenge Google processed location data across three features, Web App Activity, Location History, and Location Accuracy, from May 25, 2018, to February 4, 2020. During this period, Ireland s Dat
Supervisory Authorities & EnforcementOn September 30, 2026, the UK s Information Commissioner s Office will be replaced by the Information Commission, a body with shared governance. While the supervisory authority s functions remain the
Security & Breach NotificationThe recent IDScan breach has left many legal and compliance teams wondering, What if this happened to us? IDScan, an identity verification company, is under scrutiny after hackers allegedly exposed ov
Lawful Basis for ProcessingThe question at hand You ve built your international data transfer strategy on standard contractual clauses (SCCs). You ve mapped your processors, documented your transfers, and filed the paperwork yo
Supervisory Authorities & EnforcementWhen data protection authorities speak at industry conferences, compliance teams pay close attention. These events offer valuable insights into enforcement priorities and regulatory perspectives. At t
Privacy Governance & DesignYou don t need a breach to fail at privacy accountability. Sometimes the incident is the absence of a program itself. The Real Incident: Lack of Accountability This isn t about a specific breach or en
Data Subject RightsWhen a data subject asks you to remove their name from your online archive, you re facing a decision that pits Article 17 against Article 85 . Get it wrong, and you ll either expose your publication t
Privacy Governance & DesignThe Compliance Challenge Organizations are deploying AI systems without waiting for regulatory clarity, creating a gap between technical capability and compliance infrastructure. This has led to teams
Data Subject RightsUnderstanding the Shift The GDPR has evolved, with its private right of action provisions now forming a distinct litigation channel. Class actions alleging violations under Article 82 (right to compen
Scope & ExemptionsThe court decision on July 16, 2020, invalidating the EU-U.S. Privacy Shield didn t just void a framework. It exposed how many organizations had built their entire transatlantic data strategy on wishf
Scope & ExemptionsWhat Happened In April 2021, Portugal s supervisory authority suspended data transfers to the United States after complaints revealed census data were being sent across the Atlantic. That same week, t
Supervisory Authorities & EnforcementThe question at hand Your data protection officer just got a request from the competition law team. They want access to your data retention schedules, legitimate interests assessments, and consent man
Security & Breach NotificationYour security team discovers unauthorized access to customer records at 9pm on a Friday. The clock starts. Under Article 33 , you have 72 hours to notify your supervisory authority. What you do in tho
Supervisory Authorities & EnforcementWhat Happened On June 24, the European Data Protection Board (EDPB) launched a contact form for stakeholders to report inconsistencies in GDPR interpretation across Europe. You can now flag divergence
Lawful Basis for ProcessingWhat Changed Over the past year, case law has provided compliance teams with much-needed clarity on privacy expectations. Courts in the UK and EU have ruled on what constitutes a reasonable expectatio
