In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Supervisory Authorities & EnforcementThe Challenge Between July 2018 and April 2020, Xandr processed personal data revealing the sexual orientation of Grindr users in Norway without confirming it had a lawful basis to do so. The Norwegia
Security & Breach NotificationWhat Happened Unauthorized parties accessed Denmark s Central Person Register through a small Danish company s legitimate account over a 10-day period in September. This breach exposed names, addresse
Supervisory Authorities & EnforcementGoogle s €403 million fine from Ireland s Data Protection Commission (DPC) highlights how easily organizations can misunderstand their GDPR obligations regarding location data. The decision, which scr
Security & Breach NotificationEvery privacy officer has heard myths about metadata and personal data. These myths appear in engineering meetings, processor contracts, and sometimes even inform decisions that create real risks. The
Get weekly security insights and compliance updates delivered to your inbox.
Security & Breach NotificationYou ve inherited a third-party data sharing setup you didn t create, don t fully understand, and can t easily audit. Now you need to fix it before a supervisory authority or class action does it for y
Supervisory Authorities & EnforcementThe Court of Justice of the EU might soon change a decade of precedent. If it follows Advocate-General Maciej Szpunar s September 2026 recommendation, your data retention obligations could shift from
Security & Breach NotificationThe Problem: Why This Matters Now The CNIL s €500,000 fine against Hôpital privé de la Loire highlights the consequences of inadequate healthcare access controls. An attacker breached a single doctor
Supervisory Authorities & EnforcementAnticipating the Next Wave of Privacy Challenges Late 2019 left many privacy teams feeling exhausted but wary. After months of implementing GDPR -compliant programs, rushing to meet the CCPA s January
generalPrivacy officers in educational settings face a persistent challenge: misconceptions about what protecting children s data truly requires. These myths don t just create confusion, they lead to complia
Privacy Governance & DesignYour legal team just forwarded you an email with the subject line: Urgent: Government data request. A public health authority wants aggregated location data from your mobile app to model population mo
Privacy Governance & DesignPrivacy by design is more than just a regulatory buzzword. Article 25 of the GDPR mandates it, and supervisory authorities enforce it. Yet, many organizations treat it as a mere formality rather than
generalScope: What This Guide Covers This guide focuses on how the proposed EU Artificial Intelligence Act will integrate with your existing GDPR compliance program. It s tailored for privacy officers who ne
Scope & ExemptionsThe EU-US Data Privacy Framework has faced just one legal challenge in the past year. Yet, many privacy teams act as if every transatlantic transfer is precarious, while others assume the framework is
Privacy Governance & DesignYour standard Data Protection Impact Assessment (DPIA) template wasn t written with children in mind. It asks about data minimization and appropriate technical and organisational measures , but it doe
Scope & ExemptionsYou re facing a choice that shapes your international data transfer strategy. Since the Court of Justice of the European Union invalidated the EU-US Privacy Shield in Schrems II, you ve likely default
generalThe conventional wisdom Privacy officers across Europe are treating the CJEU s SRB ruling as a pivotal moment that fundamentally redefines what counts as personal data under GDPR . Conference presenta
Lawful Basis for ProcessingWhat Happened In December, Ring launched its Familiar Faces feature, an AI-powered facial recognition system that identifies regular visitors to a user s doorbell camera. This feature sends customized
Supervisory Authorities & EnforcementPurpose of the Template Under Article 33 GDPR , you must notify your supervisory authority of personal data breaches within 72 hours. The challenge is that each EU Member State has different requireme
Security & Breach NotificationThe question at hand When a vulnerability in SafePal s order-tracking plugin exposed the personal data of 39,798 customers, it sparked a debate among privacy officers: how deep should your technical d
Security & Breach NotificationWhat Changed Between July 29 and August 1, Ceva Logistics experienced a personal data breach affecting its European contract logistics operations. Eight warehouses were compromised, impacting multiple
