How long data may stay
From the storage limitation principle to a concrete period: how a deletion policy takes shape and which retention duties push back.
2 minutes read
Privacy, explained
Blog
How consent, cookies and data protection fit together — in plain language, with diagrams that carry the argument.
Data to the United States: where things stand after three attempts
Safe Harbor, Privacy Shield, Data Privacy Framework: the history of third-country transfers and what applies to websites today.
3 minutes read
Erasure: when it applies and when it does not
The six grounds for erasure and the five exceptions under Article 17 GDPR – and what to do when a retention duty stands in the way.
3 minutes read
Access: what a complete answer contains
The nine components of a complete access response under Article 15 GDPR, with deadlines and the limits of the right.
3 minutes read
The eight rights of data subjects
An overview of every right in Chapter III of the GDPR, with deadlines, conditions and the most common misunderstandings.
3 minutes read
Withdrawal has to be as easy as agreeing
What technically has to happen when consent is withdrawn, why it must not be harder than agreeing, and how it stays demonstrable.
3 minutes read
Whoever claims consent has to prove it
What a consent record has to contain, how long to keep it, and why an entry in the browser does not suffice.
3 minutes read
Cookie walls and pay-or-consent: paying instead of agreeing
When a cookie wall is lawful, what the EDPB said about pay-or-consent in 2024, and which third option is demanded.
3 minutes read
Why "Reject" belongs on the first layer
Why supervisory authorities across Europe require refusing to be as easy as agreeing – and how to implement it.
3 minutes read