Tag
GDPR
26 articles
Privacy
UK GDPR vs EU GDPR: the differences that matter
Where UK GDPR and EU GDPR now differ in practice: regulators, representatives, transfer tools, the Data (Use and Access) Act 2025, and what stays shared.
6 min read
Privacy
Managing sub-processors and the notice customers expect
What GDPR Article 28 requires for sub-processors, who counts as one, how to run the list and change notices, and what to do when a customer objects to a change.
6 min read
Trust and sales
Security addendums and what to negotiate
A clause-by-clause guide to a customer's security addendum: incident notice, audit rights, prescribed controls, subprocessors, deletion, and liability.
6 min read
Privacy
Controller vs processor: which one are you?
How to tell whether you are a GDPR controller or processor for each activity, why most SaaS companies are both, and what each role obliges you to do.
6 min read
Privacy
Building a data retention schedule
How to build a data retention schedule that works: the fields each entry needs, choosing trigger events, handling backups and legal holds, and proving deletion.
6 min read
Trust and sales
Security commitments in customer contracts
Where security commitments hide in customer contracts, the types you will find, why your SOC 2 report depends on them, and how to keep a register that works.
6 min read
Privacy
Data minimization in product design
How to apply data minimization while a feature is being designed: field-level purpose checks, logs, analytics, test data, and the evidence it happened.
6 min read
Privacy
Cookie consent under GDPR and ePrivacy
Why cookie consent rests on the ePrivacy Directive, what the GDPR adds, how narrow the strictly necessary exemption is, and how to test your banner.
6 min read
Privacy
GDPR for US SaaS companies
When the GDPR reaches a US SaaS company, the controller and processor roles you hold, and the obligations to put in place first, in a practical order.
6 min read
Privacy
Privacy by design under GDPR Article 25
What GDPR Article 25 requires of data protection by design and by default, how the EDPB reads it, and how to build evidence of it into your development work.
6 min read
Risk and vendors
Offboarding a vendor
How to offboard a vendor: inventory what it holds, export data, revoke every credential and DNS record, confirm deletion, update records, and keep evidence.
6 min read
Security engineering
Writing an incident response plan
An incident response plan people can follow at 3 a.m.: what it must contain, setting severity and roles, tracking notification deadlines, and what to keep.
6 min read
Privacy
Do you need a data protection officer?
The three Article 37 tests for a mandatory DPO, what core activities and large scale mean, who can hold the role, and how to record a decision not to appoint.
7 min read
Risk and vendors
Fourth-party risk, explained
What fourth-party risk is, where your vendors' vendors show up in SOC 2 reports and sub-processor lists, what GDPR and ISO 27001 expect, and what to do.
6 min read
Privacy
GDPR breach notification and the 72-hour clock
When the GDPR's 72-hour breach clock starts, what an Article 33 notice must contain, when to tell individuals, and how processors fit into the timeline.
7 min read
Risk and vendors
A vendor due diligence checklist
A pre-contract vendor due diligence checklist: assurance reports, data handling, access, incidents, contract terms, sub-processors and the approval record.
6 min read
Privacy
Handling data subject access requests on time
How to answer a GDPR access request within one month: the deadline rules, proportionate identity checks, what the response must contain, and the records.
6 min read
Privacy
Transfer impact assessments after Schrems II
What a transfer impact assessment must show after Schrems II, the EDPB's six steps, how the Data Privacy Framework changes US transfers, and what to record.
6 min read
Compliance frameworks
The SOC 2 privacy criterion compared with GDPR
How the SOC 2 privacy criteria P1 to P8 line up against GDPR, where they overlap, what GDPR requires that SOC 2 never tests, and when to include privacy.
6 min read
Privacy
Standard contractual clauses for international transfers
How the 2021 EU standard contractual clauses work: choosing a module, completing the annexes, the clauses you cannot change, and the ongoing duties.
6 min read
Privacy
What belongs in a GDPR data processing agreement
The terms Article 28(3) makes mandatory in every DPA, what each one commits a processor to in practice, and the clauses worth negotiating beyond the minimum.
6 min read
Compliance frameworks
ISO 27701 and GDPR: how they map
Where ISO 27701 controls line up with GDPR articles, where the regulation asks for more than the standard, and how to use the mapping without overclaiming.
6 min read
Privacy
When a DPIA is required under GDPR
How to tell whether GDPR Article 35 requires a DPIA: the three named cases, the nine screening criteria, national lists, and what to record if you skip.
6 min read
Privacy
How to build an Article 30 record of processing
The fields GDPR Article 30 requires of controllers and processors, how to structure the record by purpose, and the habits that keep it accurate.
6 min read