In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Supervisory Authorities & EnforcementGoogle s €403 million fine from Ireland s Data Protection Commission (DPC) highlights how easily organizations can misunderstand their GDPR obligations regarding location data. The decision, which scr
Security & Breach NotificationThe question at hand Your security budget request is on the CFO s desk. You re asking for continuous monitoring tools, automated threat detection, and enhanced software validation processes. The respo
Supervisory Authorities & EnforcementThe Irish Data Protection Commission s €403 million fine against Google for location data processing violations between May 2018 and February 2020 offers a clear view into how supervisory authorities
Data Subject RightsYou re redesigning your privacy notice. Your legal team wants to list a phone number for rights requests. Your customer service team suggests using your existing premium-rate line to handle the volume
Get weekly security insights and compliance updates delivered to your inbox.
Lawful Basis for ProcessingThe Challenge Google processed location data across three features, Web App Activity, Location History, and Location Accuracy, from May 25, 2018, to February 4, 2020. During this period, Ireland s Dat
Security & Breach NotificationThe Spanish Data Protection Agency (AEPD) recently received its first notification of a personal data breach allegedly executed by an AI agent powered by a large language model. The agent searched for
Security & Breach NotificationWhat Happened On September 14, Spain s supervisory authority reported the country s first personal data breach executed by an agentic AI system. The AI agent, using a known language model, scanned gen
Security & Breach NotificationEvery privacy officer has heard myths about metadata and personal data. These myths appear in engineering meetings, processor contracts, and sometimes even inform decisions that create real risks. The
Security & Breach NotificationAn autonomous AI agent breached a Spanish company s network, altered personal data records, and extracted invoice information. Spain s supervisory authority confirmed it s their first reported inciden
Security & Breach NotificationA New Threat: AI-Driven Cyber Attacks Should your security and data protection models treat AI-driven attacks as a fundamentally different threat category requiring new defensive architectures, or can
Security & Breach NotificationWhen an external-facing system becomes the entry point for unauthorized data access, you re facing a choice that should have been made months earlier: which API appropriate technical and organisationa
Supervisory Authorities & EnforcementOn September 30, 2026, the UK s Information Commissioner s Office will be replaced by the Information Commission, a body with shared governance. While the supervisory authority s functions remain the
Data Subject RightsThe CNIL s April 2025 audit of EXTIA revealed a compliance breakdown that should prompt every DSAR operator to reassess their processes. Of 265 erasure requests received in 2024, more than three-quart
Supervisory Authorities & EnforcementThese questions come from a DPO roundtable I attended last month, right after Grindr s £26m settlement hit the news. The room went quiet when someone asked: Could our pre-acquisition data practices tr
Security & Breach NotificationWhen the CNIL imposed a €500,000 fine on Hôpital Privé de la Loire in 2025, it wasn t due to sophisticated malware. The attacker used a single compromised user account to access data on 524,867 patien
Data Subject RightsThe Conventional Wisdom Many DSAR teams think they ve nailed erasure compliance by using automated deletion workflows. They set up retention policies, configure systems to purge records after a set pe
Security & Breach NotificationYou ve inherited a third-party data sharing setup you didn t create, don t fully understand, and can t easily audit. Now you need to fix it before a supervisory authority or class action does it for y
Security & Breach NotificationThe Question at Hand A breach involving 153 million driver s licenses has reignited a debate in privacy circles: should large datasets of personal information fall under regulatory frameworks as stric
Supervisory Authorities & EnforcementWhat Happened Belgium s third attempt at establishing a lawful data retention regime in 2022 required online service providers to store identification, traffic, and location metadata to combat cybercr
Supervisory Authorities & EnforcementThe Court of Justice of the EU might soon change a decade of precedent. If it follows Advocate-General Maciej Szpunar s September 2026 recommendation, your data retention obligations could shift from
