In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Supervisory Authorities & EnforcementScope - What This Guide Covers This guide focuses on the new requirement for UK controllers to establish formal data protection complaint handling processes under section 164A of the Data Protection A
generalThe European Commission s November 19 omnibus packages introduced two proposals that will reshape your approach to AI compliance. One targets the GDPR , while the other proposes delaying regulation of
Lawful Basis for ProcessingWhat Happened In December, Ring launched its Familiar Faces feature, an AI-powered facial recognition system that identifies regular visitors to a user s doorbell camera. This feature sends customized
Supervisory Authorities & EnforcementThe EDPB and AMLA are drafting Joint Guidelines on sharing information for financial crime prevention without violating data protection laws. Your organization has until 10 July 2027 to establish the
Get weekly security insights and compliance updates delivered to your inbox.
Supervisory Authorities & EnforcementPurpose of the Template Under Article 33 GDPR , you must notify your supervisory authority of personal data breaches within 72 hours. The challenge is that each EU Member State has different requireme
Supervisory Authorities & EnforcementThe EDPB adopted a standardized DPIA template on 10 March 2026, followed by a common breach notification template on 8 June. Both stemmed from the Helsinki Statement, the EDPB s July 2025 commitment t
Security & Breach NotificationWhen Oracle warned Nissan of a zero-day exploit in PeopleSoft, the carmaker was already compromised. Between May 27 and June 9, attackers linked to the ShinyHunters group accessed sensitive employee d
Supervisory Authorities & EnforcementThe recent EDPB plenary introduced new guidelines that could reshape how you handle anonymisation, web scraping, and blockchain. If you re responsible for data privacy, you re likely wondering how the
Security & Breach NotificationThe question at hand When a vulnerability in SafePal s order-tracking plugin exposed the personal data of 39,798 customers, it sparked a debate among privacy officers: how deep should your technical d
Supervisory Authorities & EnforcementThese questions stem from a conversation with a Data Protection Officer (DPO) after the ICO reprimanded the Criminal Records Office. The breach affected over 10,000 people, exposing biometric data and
Security & Breach NotificationThe Conventional Wisdom When ransomware operators demand payment, the standard advice is clear: don t pay. The FBI , CISA warns against it, and your cyber insurance policy likely advises refusal. The
Security & Breach NotificationWhen Manchester Airports Group discovered unauthorized access to customer data from three UK airports, they followed the standard protocol: contain the risk, notify authorities, and contact affected c
Supervisory Authorities & EnforcementAn automated system flags a driver s account for low ratings. Within seconds, the account locks. No human reviews the context, no one considers mitigating factors, and the driver s income stops. The D
Security & Breach NotificationThe Problem: Why This Matters Now Your incident response plan might be tucked away in a SharePoint folder, labeled something like IR_Plan_v3_FINAL_updated.docx . When Manchester Airports Group faced a
Security & Breach NotificationWhen ShinyHunters dumped what it claimed was 50GB of Carhartt customer data in August, the headline number looked catastrophic: twenty-five million email addresses. Except it wasn t true. Troy Hunt s
Security & Breach NotificationThe Challenge On a Tuesday morning, Manchester Airports Group (MAG) discovered unauthorized access to customer data at three major English airports. The breach exposed 8.7 million records, including e
Security & Breach NotificationThe Manchester Airports Group breach exposed 8.7 million customer records because attackers exploited the expanded attack surface that comes with remote work. When your team connects from coffee shops
Lawful Basis for ProcessingWhen Amadeus IT Group repurposed booking data for a traveller profiling pilot, they triggered an €18 million fine from Spain s supervisory authority. The breaches weren t unusual; they were fundamenta
Security & Breach NotificationOverview of the Breach France s General Directorate of Public Finances (DGFiP) confirmed a personal data breach affecting about 600,000 individuals and businesses. The exposed data included tax identi
Supervisory Authorities & EnforcementYour force just approved a live facial recognition trial, believing it ll speed up crime detection. Now, your inbox is flooded with questions, and the ICO s latest audit findings aren t helping. These
