Page 2 of 12
Buying guide for Singapore companies subject to the GDPR: EEA hosting, Art. 30 records for controller and processor activities, DSAR workflow, Art. 27 representative records, dual PDPA + GDPR registers.
Health data needs an Art. 9(2) condition on top of an Art. 6 lawful basis. Controller mapping across providers, insurers and vendors, why consent fails in care, Art. 9(4) national law.
Most Indian companies meet the GDPR as processors for European clients, not through Art. 3(2) targeting. What Arts. 28, 30(2), 32 and 33(2) require, and why health data is audited hardest.
The MDR Art. 11 Authorised Representative does not satisfy GDPR Art. 27. Two separate appointments, plus controller/processor status for telemetry, post-market surveillance versus minimisation, and SaMD.
When the GDPR reaches a Singapore business under Art. 3(2), the processor nuance that catches regional service centres, the Art. 27 representative duty, and what follows for health data.
Which Art. 9(2) conditions health organisations actually rely on and how each one fails: explicit consent, 9(2)(h) with the Art. 9(3) secrecy trap, public health, and research under Art. 89(1).
India has no EU adequacy decision. Which SCC module applies to an Indian processor, how to run the transfer impact assessment, and how to answer the government-access questions.
The PDPA's consent-centric model against the GDPR's six lawful bases: access rights, the absence of a special-category tier, the DNC registry, breach notification timing, and PDPC enforcement.
PIPEDA's ten principles against the GDPR's structure: consent, erasure, breach reporting to the OPC, Quebec Law 25, enforcement powers and the state of federal reform.
The 13 Australian Privacy Principles against the GDPR's structure: lawful bases, consent, data subject rights, the NDB scheme vs Art. 33/34, OAIC vs EU supervisory authorities, and the reform direction.
Singapore has no EU adequacy decision, and the EU–Singapore Digital Trade Agreement is not one. Which SCC module applies, how to run the transfer impact assessment, and the contract path.
Honest review of AI Act compliance software in 2026: governance platforms, risk tools, bias testing, and where the market actually stands.
Complete guide to AI Act high-risk AI systems obligations: Annex III categories, six core requirements, conformity assessment, CE marking, and GDPR interactions.
Learn how the EU AI Act risk classification works across four tiers, from banned practices to minimal risk, and determine where your AI system falls.
AI Act vs GDPR compared: scope, risk approach, enforcement, overlap on transparency, DPIAs, and automated decisions. Practical dual-compliance guidance.
A practical guide to EU AI Act compliance in 2026 covering risk categories, high-risk obligations, GPAI rules, timelines, and GDPR intersections.
High-risk AI obligations deferred to Dec 2027; Art. 50 transparency still Aug 2026. €35M max fine, full deadline calendar by article + GDPR overlap.
EU AI Act effective dates 2024-2027: full phase-in timeline, prohibited practices, GPAI, high-risk systems, fines €35M/7%, official sources.