A privacy notice somebody can actually read
What Articles 13 and 14 GDPR require in a privacy notice and how to structure it so that it serves its purpose.
3 minutes read
Privacy, explained
Data protection in practice
From the contact form to the newsletter: how the rules translate into the everyday work of a website and a small team.
A data breach: 72 hours, and what to do in them
What counts as a personal data breach, when it has to be reported, what goes into the notification, and when the people affected have to be told.
2 minutes read
The impact assessment: when it becomes mandatory
When a data protection impact assessment is needed, which nine criteria help decide, and what belongs in the document.
3 minutes read
How long data may stay
From the storage limitation principle to a concrete period: how a deletion policy takes shape and which retention duties push back.
2 minutes read
Whoever claims consent has to prove it
What a consent record has to contain, how long to keep it, and why an entry in the browser does not suffice.
3 minutes read
Cookie walls and pay-or-consent: paying instead of agreeing
When a cookie wall is lawful, what the EDPB said about pay-or-consent in 2024, and which third option is demanded.
3 minutes read
Why "Reject" belongs on the first layer
Why supervisory authorities across Europe require refusing to be as easy as agreeing – and how to implement it.
3 minutes read
The six tricks in a consent banner
Hidden refusal, confirmshaming, false urgency: the common dark patterns in consent banners and why they invalidate consent.
2 minutes read