GDPR
GDPR compliance guides and analysis — lawful basis, data subject rights, DPIAs, transfers, and supervisory authority enforcement decisions across EU27.
EDPB 02/2026 Anonymisation Rules: What Tech Teams Must Know
EDPB Guidelines 02/2026 redefine anonymous data under GDPR. Discover the 3-step test and why masked AI datasets and embeddings remain regulated personal data.
Lignes directrices CEPD 02/2026 : Anonymisation et IA
Les lignes directrices 02/2026 du CEPD redéfinissent l'anonymisation RGPD. Découvrez pourquoi les données IA pseudonymisées restent des données personnelles.
EDSA-Richtlinien 02/2026: Anonymisierung für KI & Tech
Die EDSA-Richtlinien 02/2026 definieren anonyme Daten neu. Erfahren Sie, warum pseudonymisierte KI-Daten und Vektoren weiterhin der DSGVO unterliegen.
Schrems II and Consent Management: What EU Organisations Must Do Now
The ECJ's Schrems II ruling (C-311/18) invalidated the EU-US Privacy Shield and imposed additional safeguards on standard contractual clauses. This guide explains what consent managers and EU SMEs must do to remain GDPR-compliant for transatlantic data transfers.
How to Build a ROPA Under GDPR: A Practical Guide
Records of Processing Activities (ROPA) are required under GDPR Article 30 for most organisations. This guide covers what must be recorded, who is exempt, and how to build and maintain a ROPA your DPA will accept.
What Is GDPR? A Complete Guide for Businesses
GDPR (Regulation 2016/679) is the EU's data protection law. This guide covers the 6 lawful bases, data subject rights, ROPA, DPO, DPIA, and Article 83 fines — with practical guidance for SMEs.
DPIA Step-by-Step: When You Need One and How to Write It
A Data Protection Impact Assessment (DPIA) is mandatory under GDPR Article 35 for high-risk processing. This step-by-step guide walks through when one is required, what it must contain, and how to complete one efficiently.
GDPR DPIA: When You Need One and How to Write It
A Data Protection Impact Assessment is mandatory before high-risk processing under GDPR Article 35. This guide explains triggers, methodology, and documentation.
How to Audit Third-Party Data Processors Under GDPR
GDPR Article 28 requires organisations to use only processors providing sufficient guarantees. This guide explains how to audit vendors and maintain compliant DPAs.
GDPR Software vs. Data Protection Officer: A Decision Guide for SMEs
Do you need to appoint an external Data Protection Officer, or is GDPR compliance software enough? This guide explains when you are legally required to appoint a DPO under EU law and national rules, and when software is the more effective and cost-efficient choice.
GDPR Breach Notification: 72-Hour Timeline & Data Protection Authority Reporting
GDPR Article 33 requires you to notify data protection authorities of a personal data breach within 72 hours of becoming aware. This guide explains what counts as a breach, when the clock starts, who to notify, and what to include.
GDPR Data Subject Rights: Access, Deletion, Rectification (30-Day Deadline)
Individuals have the right to request access to their personal data, have it corrected, or deleted — and you must respond within 30 calendar days. This guide explains each right, what triggers your obligation, and how to respond on time.
GDPR Six Lawful Bases for Processing: Choose Your Legal Foundation (Article 6)
GDPR Article 6 requires you to have at least one lawful basis before processing personal data. There are six: consent, contract, legal obligation, vital interests, public task, and legitimate interests. This guide explains each, with examples and a decision tree.