The map without which nothing can be checked
The record of processing activities under Article 30 GDPR: who is subject to the duty, what belongs in it, and why the 250-employee threshold almost never exempts anyone.
4 minutes read
Privacy, explained
Blog
How consent, cookies and data protection fit together — in plain language, with diagrams that carry the argument.
Taking along what was once given
The right to data portability under Article 20 GDPR: which data it covers, where the line to the right of access runs, and what a machine-readable format means.
4 minutes read
Collected for what? The question stays binding
Purpose limitation under Article 5 GDPR: what a specified purpose is, how the compatibility test in Article 6(4) works, and where the line to a change of purpose runs.
3 minutes read
As little as possible, as much as necessary
Data minimisation under Article 5 GDPR: why purpose is the yardstick, how to spot superfluous fields, and what the principle means for consent banners.
3 minutes read
Privacy as a design decision, not a retrofit
What privacy by design and by default concretely mean, with examples from building a website.
3 minutes read
A privacy notice somebody can actually read
What Articles 13 and 14 GDPR require in a privacy notice and how to structure it so that it serves its purpose.
3 minutes read
What lies behind "799 partners"
How real-time bidding and the Transparency and Consent Framework fit together, and why the Belgian authority found against the TCF in 2022.
3 minutes read
One signal instead of a thousand banners
How Global Privacy Control works, what the 2022 Berlin judgment means, and why Do Not Track failed.
3 minutes read
What a cookie scan finds – and what it misses
How a cookie scanner works, which five blind spots it has, and how to close the gaps.
2 minutes read