Latest 18 articles, page 1 of 2
Keep a defensible DPA version log: capture the document reviewed, classify changes, assign decisions and preserve superseded evidence.
Why cookie banners frustrate users, when EU device-access consent is required, and which narrow exemptions may apply to necessary and audience-measurement cookies.
A practical review of privacy-workflow scope, evidence, implementation and procurement questions.
Plan GDPR costs from scoped work, staffing, vendors, security and tooling. Includes a budget worksheet and a clearly hypothetical calculation.
Opt-in means ask first; opt-out means stop on request. When GDPR requires each, with a comparison table and examples for email, cookies, calls and data sharing.
Art. 35(3)(b) names large-scale Art. 9 processing, so a health DPIA is rarely optional. The Art. 35(7) content applied to a clinical system, WP248 criteria, Art. 36 prior consultation, and when to redo it.
Canada's adequacy decision does not exempt Canadian companies from the GDPR. When Art. 3(2) applies, the Art. 27 EU representative duty, and what health data changes.
Health data needs an Art. 9(2) condition on top of an Art. 6 lawful basis. Controller mapping across providers, insurers and vendors, why consent fails in care, Art. 9(4) national law.
Most Indian companies meet the GDPR as processors for European clients, not through Art. 3(2) targeting. What Arts. 28, 30(2), 32 and 33(2) require, and why health data is audited hardest.