Tag
Eu Regulation
16 articles
Privacy
UK GDPR vs EU GDPR: the differences that matter
Where UK GDPR and EU GDPR now differ in practice: regulators, representatives, transfer tools, the Data (Use and Access) Act 2025, and what stays shared.
6 min read
Compliance frameworks
NIS2 incident reporting timelines
When an incident is significant under NIS2, what the early warning, notification and final report must contain, when each clock starts, and who else to tell.
6 min read
Compliance frameworks
NIS2 cybersecurity risk management measures
The ten cybersecurity risk management measures in NIS2 Article 21, what each one asks for in practice, the evidence to keep, and how ISO 27001 maps to them.
6 min read
Compliance frameworks
NIS2 essential vs important entities
How NIS2 decides whether you are in scope, how it sorts entities into essential and important, and what the label changes for supervision and enforcement.
6 min read
Privacy
Cookie consent under GDPR and ePrivacy
Why cookie consent rests on the ePrivacy Directive, what the GDPR adds, how narrow the strictly necessary exemption is, and how to test your banner.
6 min read
Compliance frameworks
DORA vs NIS2: which applies to you
How to tell whether DORA, NIS2 or both apply to your organization, how the EU resolves the overlap for financial entities, and where ICT providers sit.
6 min read
Compliance frameworks
DORA contract requirements for ICT services
The clauses DORA Article 30 requires in every ICT services contract, the extra terms for critical or important functions, and what providers should negotiate.
7 min read
Compliance frameworks
DORA resilience testing and TLPT
What DORA's testing program requires every year, which entities must run threat-led penetration tests, who may test, and what ICT providers must do.
6 min read
Compliance frameworks
DORA third-party risk and the register of information
How DORA's Articles 28 and 29 govern ICT third-party risk, what the register of information must hold, and how to assess, monitor and exit ICT providers.
6 min read
Privacy
Transfer impact assessments after Schrems II
What a transfer impact assessment must show after Schrems II, the EDPB's six steps, how the Data Privacy Framework changes US transfers, and what to record.
6 min read
Compliance frameworks
The SOC 2 privacy criterion compared with GDPR
How the SOC 2 privacy criteria P1 to P8 line up against GDPR, where they overlap, what GDPR requires that SOC 2 never tests, and when to include privacy.
6 min read
Privacy
Standard contractual clauses for international transfers
How the 2021 EU standard contractual clauses work: choosing a module, completing the annexes, the clauses you cannot change, and the ongoing duties.
6 min read
Compliance frameworks
DORA incident reporting
How DORA defines a major ICT-related incident, the classification criteria, the three reports owed to supervisors, and the runbook that meets each deadline.
6 min read
Compliance frameworks
ISO 27701 and GDPR: how they map
Where ISO 27701 controls line up with GDPR articles, where the regulation asks for more than the standard, and how to use the mapping without overclaiming.
6 min read
Compliance frameworks
The DORA ICT risk management framework
What Articles 5 to 16 of DORA require in an ICT risk management framework, who must own it, how often it is reviewed, and the evidence a supervisor expects.
7 min read
Compliance frameworks
DORA explained for ICT service providers
What DORA requires of EU financial entities, how those duties reach their ICT providers through contracts, registers and testing, and what to prepare first.
7 min read