The map without which nothing can be checked
The record of processing activities under Article 30 GDPR: who is subject to the duty, what belongs in it, and why the 250-employee threshold almost never exempts anyone.
4 minutes read
Privacy, explained
Law and duties under the GDPR
What the GDPR and the ePrivacy Directive require, which duties follow from them, and how regulators and courts read them.
Data to the United States: where things stand after three attempts
Safe Harbor, Privacy Shield, Data Privacy Framework: the history of third-country transfers and what applies to websites today.
3 minutes read
The contract almost every website needs
What a data processing agreement has to contain, when it is needed, and what role sub-processors play.
3 minutes read
Who is responsible – and who merely carries out
The three GDPR roles explained: who determines purposes and means, who follows instructions, and when joint controllership arises.
3 minutes read
Legitimate interests: the balancing test nobody writes down
When legitimate interests carry: the three steps of interest, necessity and balancing – and why they do not help with cookie access.
3 minutes read
When consent actually counts
Freely given, informed, unambiguous, purpose-specific: the four conditions for valid consent under the GDPR.
3 minutes read
The six permissions in the GDPR
Consent, contract, legal obligation, vital interests, public task, legitimate interests: the six legal bases with examples.
3 minutes read