Category
Privacy
GDPR, CCPA and the privacy work underneath them: records of processing, impact assessments, data subject requests and international transfers.
17 articles
Privacy
UK GDPR vs EU GDPR: the differences that matter
Where UK GDPR and EU GDPR now differ in practice: regulators, representatives, transfer tools, the Data (Use and Access) Act 2025, and what stays shared.
6 min read
Privacy
Managing sub-processors and the notice customers expect
What GDPR Article 28 requires for sub-processors, who counts as one, how to run the list and change notices, and what to do when a customer objects to a change.
6 min read
Privacy
Controller vs processor: which one are you?
How to tell whether you are a GDPR controller or processor for each activity, why most SaaS companies are both, and what each role obliges you to do.
6 min read
Privacy
Building a data retention schedule
How to build a data retention schedule that works: the fields each entry needs, choosing trigger events, handling backups and legal holds, and proving deletion.
6 min read
Privacy
Data minimization in product design
How to apply data minimization while a feature is being designed: field-level purpose checks, logs, analytics, test data, and the evidence it happened.
6 min read
Privacy
Cookie consent under GDPR and ePrivacy
Why cookie consent rests on the ePrivacy Directive, what the GDPR adds, how narrow the strictly necessary exemption is, and how to test your banner.
6 min read
Privacy
GDPR for US SaaS companies
When the GDPR reaches a US SaaS company, the controller and processor roles you hold, and the obligations to put in place first, in a practical order.
6 min read
Privacy
Privacy by design under GDPR Article 25
What GDPR Article 25 requires of data protection by design and by default, how the EDPB reads it, and how to build evidence of it into your development work.
6 min read
Privacy
Do you need a data protection officer?
The three Article 37 tests for a mandatory DPO, what core activities and large scale mean, who can hold the role, and how to record a decision not to appoint.
7 min read
Privacy
GDPR breach notification and the 72-hour clock
When the GDPR's 72-hour breach clock starts, what an Article 33 notice must contain, when to tell individuals, and how processors fit into the timeline.
7 min read
Privacy
Handling data subject access requests on time
How to answer a GDPR access request within one month: the deadline rules, proportionate identity checks, what the response must contain, and the records.
6 min read
Privacy
Transfer impact assessments after Schrems II
What a transfer impact assessment must show after Schrems II, the EDPB's six steps, how the Data Privacy Framework changes US transfers, and what to record.
6 min read
Privacy
Standard contractual clauses for international transfers
How the 2021 EU standard contractual clauses work: choosing a module, completing the annexes, the clauses you cannot change, and the ongoing duties.
6 min read
Privacy
What belongs in a GDPR data processing agreement
The terms Article 28(3) makes mandatory in every DPA, what each one commits a processor to in practice, and the clauses worth negotiating beyond the minimum.
6 min read
Privacy
When a DPIA is required under GDPR
How to tell whether GDPR Article 35 requires a DPIA: the three named cases, the nine screening criteria, national lists, and what to record if you skip.
6 min read
Privacy
How to build an Article 30 record of processing
The fields GDPR Article 30 requires of controllers and processors, how to structure the record by purpose, and the habits that keep it accurate.
6 min read
Privacy
The six GDPR lawful bases, and how to choose one
What each of the six Article 6 lawful bases requires, which ones a SaaS company can rely on, and how to choose and record a basis before processing.
7 min read