Tagged
EDPB
A user ID that never changes keeps data personal under GDPR, even if hashed
Italy's data protection authority fined IQVIA 7 million euros for treating a patient database as anonymous when each pa…
11 Oct 2026
BBVA fined 5.5 million euros after an app opt-out never reached its marketing tool
Italy's data protection authority fined BBVA 5,508,000 euros after a customer switched off promotional notifications in…
10 Oct 2026
If your SaaS imports personal data, list its sources. The 2026 GDPR transparency check asks your customers.
In 2026, 25 European data protection authorities are questioning recruiters, healthcare, finance, marketing and public…
7 Oct 2026
A DSA illegal content report form should accept reports without a name or email
If people in the EU can upload, publish or share content through your product, the Digital Services Act requires a way…
29 Sep 2026
In a high-risk data breach, GDPR says to tell everyone affected, not only your users
After a breach likely to put people at high risk, GDPR Article 34 requires telling every affected person, including peo…
27 Sep 2026
Every contact you publish for GDPR data requests must be easy to use on its own
Spain's regulator fined Securitas Direct 100,000 euros for a paid 902 phone line on its camera signs, even though its p…
23 Sep 2026
A GDPR fix counts for more if you made it before you heard from the regulator
The date you repaired a GDPR problem decides how much the repair is worth to you. One made before you learned an author…
22 Sep 2026
GDPR gives you one month to answer a deletion request, even if the data is already deleted
On 21 July 2026 the CNIL fined the IT consultancy EXTIA 300,000 euros over deletion requests, mostly because 166 people…
12 Sep 2026
Your app sends personal data outside the EU. Each destination needs its own transfer mechanism.
Making personal data available to a separate company outside the EEA is a transfer, and GDPR Chapter V requires a named…
11 Sep 2026
How long can you keep user data? Write down the period, then make something enforce it.
Set a period for each category of data you hold, publish it, and build something that enforces it. GDPR Article 5(1)(e)…
4 Sep 2026
Does your new feature need a DPIA? Decide before you ship, and write the answer down.
A data protection impact assessment (DPIA) is mandatory under GDPR Article 35 where processing is likely to result in a…
3 Sep 2026
Do you need a DPA with every vendor? Sort your list into three groups first.
No. GDPR Article 28(3) requires a written contract only where a vendor is your processor, meaning it handles the data o…
26 Aug 2026
Article 33 asks four things. The EDPB's new breach template asks 100.
The EDPB's draft template for personal data breach notification, which went out for comment until 5 August 2026, turns…
3 Aug 2026
Scraping the whole internet is the easy case. Your small, targeted scrape is not.
The EDPB's draft Guidelines 03/2026 cover web scraping for generative AI, and they reach the team that re-uses someone…
3 Aug 2026
Your Privacy Policy says "anonymised". The EDPB just asked: for whom?
The EDPB's draft Guidelines 02/2026, out for consultation until 30 October 2026, treat anonymity as relative: the same…
31 Jul 2026