In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Privacy Governance & DesignWhen two organizations receive the same data protection maturity score, you d expect them to face similar compliance risks. They don t. White Label Consultancy s assessment work reveals a pattern that
Lawful Basis for ProcessingWhy these mistakes keep happening Higher education institutions often rush to adopt collaborative platforms. Your procurement team signs off on a cloud tool, IT rolls it out, and faculty start uploadi
Security & Breach NotificationYour incident response team just declared the breach over. Systems are back online, customers can log in, and your board s been briefed. But here s what nobody s asking: did you actually remove the at
Supervisory Authorities & EnforcementThe U.K. Information Commissioner s Office s Age Appropriate Design Code outlines 15 standards for online services that process children s personal data. If your service is likely to be accessed by ch
Get weekly security insights and compliance updates delivered to your inbox.
Data Subject RightsUnderstanding the Shift The GDPR has evolved, with its private right of action provisions now forming a distinct litigation channel. Class actions alleging violations under Article 82 (right to compen
Scope & ExemptionsThe court decision on July 16, 2020, invalidating the EU-U.S. Privacy Shield didn t just void a framework. It exposed how many organizations had built their entire transatlantic data strategy on wishf
Security & Breach NotificationQuestions started landing in my inbox after a Canadian supervisory authority announced its investigation into Human Resources and Skills Development Canada following a breach affecting student loan re
Scope & ExemptionsYou re facing a choice that shapes your international data transfer strategy. Since the Court of Justice of the European Union invalidated the EU-US Privacy Shield in Schrems II, you ve likely default
Scope & ExemptionsWhat Happened In April 2021, Portugal s supervisory authority suspended data transfers to the United States after complaints revealed census data were being sent across the Atlantic. That same week, t
Privacy Governance & DesignThe Challenge The Office of the Privacy Commissioner (OPC) contacted app developers as part of a coordinated Global Privacy Enforcement Network (GPEN) sweep to address privacy communications. The swee
Supervisory Authorities & EnforcementThe question at hand Your data protection officer just got a request from the competition law team. They want access to your data retention schedules, legitimate interests assessments, and consent man
Supervisory Authorities & EnforcementJohn Edwards took office as U.K. Information Commissioner on January 4, 2022, marking a shift in the ICO s approach. If your compliance program treats the ICO as static, you re already behind. Edwards
Security & Breach NotificationYour security team discovers unauthorized access to customer records at 9pm on a Friday. The clock starts. Under Article 33 , you have 72 hours to notify your supervisory authority. What you do in tho
generalThe conventional wisdom Privacy officers across Europe are treating the CJEU s SRB ruling as a pivotal moment that fundamentally redefines what counts as personal data under GDPR . Conference presenta
Security & Breach NotificationWhen a national security agency admits to unlawfully processing personal data for three years, the issue wasn t complex technology or legal nuances. MI5 s failures between 2016 and 2019 were due to no
Supervisory Authorities & EnforcementWhat Happened On June 24, the European Data Protection Board (EDPB) launched a contact form for stakeholders to report inconsistencies in GDPR interpretation across Europe. You can now flag divergence
Supervisory Authorities & EnforcementWhen your IT infrastructure spans multiple jurisdictions, you re not just managing servers and APIs. You re dealing with various supervisory authorities, each with its own enforcement priorities. The
Supervisory Authorities & EnforcementThe European Data Protection Board (EDPB) publishes guidelines, adopts consistency findings, and issues opinions. Your team reads them, implements them, and assumes you re aligned with supervisory aut
Lawful Basis for ProcessingWhat Changed Over the past year, case law has provided compliance teams with much-needed clarity on privacy expectations. Courts in the UK and EU have ruled on what constitutes a reasonable expectatio
Data Subject RightsYour team processes erasure requests. Someone objects to direct marketing. Another person wants their account deleted. You respond within 30 days, document the decision, and move on. But are you actua
