Explore Legiscope and its GDPR workflows.

Legiscope

Pricing

See Legiscope in a live product demonstration.

Book a demo

Contact Legiscope

The history of Legiscope and the people building it.

About Legiscope

Explore the Article 30 register of processing activities.

Record of processing activities — RoPA

Explore the data protection impact assessment workflow.

Data protection impact assessments — DPIA

Applications

Explore processor relationships and Article 28 contract assessments.

Processors

Explore incident assessment and notification workflows.

Personal data breaches and incidents

Explore the workflow for personal data rights requests.

Data subject rights requests

Explore compliance audits, evidence and priorities.

GDPR audits

Art. 4(1) GDPR defines personal data as any information relating to an identifiable person. Learn the definition, examples, special categories, and key CJEU rulings.

Personal Data Under GDPR: Definition

DPO tasks per Articles 37-39 GDPR: designation thresholds, 9 EDPB-mandated tasks, independence + €170K conflict-of-interest fine + 17K-org survey findings.

DPO Role Under GDPR (Art. 37-39): Tasks + EDPB 2024 Report

Implementing privacy by design under Article 25 GDPR: what the legal obligation really requires and the operational steps to build it into your IT projects.

Implementing Privacy By Design (GDPR)

The GDPR requires obtaining the consent of individuals before processing their personal data in certain cases, here's how to do that

Tutorial: how to get a valid GDPR consent

The General Data Protection Regulation (GDPR) is one of the most important regulation in the European Union in the field of data protection

What is GDPR ?

GDPR vs AML conflicts: 5-10 year retention, KYC data minimization, AMLA 2026 launch, sanctions screening. Resolutions per Art. 6(1)(c) + Art. 23.

GDPR and AML: 5 Compliance Conflicts + Resolution Guide 2026

A Comprehensive Guide to Using 'Legitimate Interests' as a Legal Basis under the GDPR, Including Challenges, Conditions, and Practical Examples

How to Conduct the Triple Test to Assess the Legitimate Interests of the Data Controller (GDPR)

The CNIL has just imposed a €500,000 fine on a company for conducting commercial prospecting without complying with the GDPR

GDPR and Outbound sales : €500,000 fines for non-compliance

Article 28 of the GDPR is a critical juncture for compliance, governing the relationship between data controllers and processors

Article 28 of the GDPR: Obligations Imposed on Processors

Here is the list of GDPR information notices that you must mandatorily provide before collecting personal data

GDPR Information notices, a few things you need to know

How to design a questionnaire that is compliant with the GDPR and ensures data collection in accordance with the law

How to Create a GDPR Compliant Questionnaire (Surveys, Satisfaction Inquiries, etc.)

When a DPO is mandatory under GDPR Article 37, how to appoint one, and recent EDPB enforcement findings.

GDPR DPO Designation: Article 37 Requirements Explained

Only the DPO is regulated by the GDPR. See how the Data Protection Officer differs from a compliance officer, when it is mandatory, and who appoints one.

DPO or compliance officer ?

The GDPR gives the Data Protection Officer specific tasks: informing and advising, monitoring compliance, staff training and advising on DPIAs under Article 39.

Tasks of the data protection officer

Art. 38 GDPR rules on DPO independence: 4 dismissal-protection cases (CJEU C-453/21, X-FAB, Würth), reporting to top management, conflict of interest tests.

DPO Position GDPR (Art. 38): Independence Rules + 2026 Cases

The GDPR accuracy principle under Article 5(1)(d): what it requires, how to implement it in practice, and how opinions and historical records are treated.

GDPR Accuracy Principle: What Article 5(1)(d) Requires in 2026

Data minimization means collecting only what a purpose requires. Article 5(1)(c) explained: the three tests, field-by-field examples, CJEU rulings, fines.

Data Minimization Under GDPR: Rules, Examples and Fines

The GDPR requires the collection of consent from individuals before processing their personal data in certain cases, here's how to do that

How to get a valid consent under the GDPR

Article 5 of the GDPR lays out key principles related to the purposes for which personal data can be processed.

The Purposes of Processing under the GDPR

Meta €1.2B fine. 15 adequate countries (Switzerland renewed 2024). SCC vs BCR vs DPF decision tree + Transfer Impact Assessment template inside.

GDPR Data Transfer Rules 2026: SCC, BCR, Adequacy Decision Tree

Art. 4(8) GDPR defines data processors as entities processing personal data on behalf of controllers. Learn their duties, Art. 28 contracts, and enforcement risks.

What Is a Data Processor Under GDPR?

An in-depth analysis of the applicability of GDPR to non-EU companies, including legal obligations, case studies, and practical compliance strategies.

Does GDPR Apply to Companies Outside of the European Union?

Step-by-step 72-hour breach playbook: assess, notify DPA, inform subjects + Meta €265M, Marriott £18.4M cases. Articles 33 + 34 GDPR workflow + template.

GDPR Data Breach Response: 72h Playbook + 2026 Cases

Article 5(1)(b) compatible-use test. 7 enforcement cases (€100M+ collectively). Purpose documentation template + CNIL/EDPB compatibility criteria 2026.

GDPR Purpose Limitation: 7 Examples + Documentation Template

GDPR supervisory authorities explained: investigative and corrective powers, one-stop-shop mechanism, EDPB coordination, and fines.

Supervisory Authorities Under the GDPR Explained

An in-depth analysis of the GDPR's principle of accountability, including legal references, case studies, and practical implementation tips.

What is the Principle of Accountability?

Art. 20 applies only with consent/contract + automated processing. JSON/CSV/XML format. Provided vs derived data + 30-day response deadline workflow.

GDPR Right to Data Portability (Art. 20): When + Format

An in-depth analysis of the European Data Protection Board's role in enforcing GDPR, including legal frameworks, case studies, and practical compliance tips.

The Role of the European Data Protection Board (EDPB)

Step-by-step GDPR compliance guide for e-commerce: cookie consent, checkout data, payment processor agreements, cross-border selling, and data retention rules.

E-Commerce GDPR Compliance: Step-by-Step

Retention periods by sector: HR 5y, customers 3y, accounting 10y. Amazon €746M case. Article 5(1)(e) deletion rules + retention policy template.

GDPR Storage Limitation: Retention Periods by Sector (2026)

Analysis of the economic and productivity losses caused by cookie banners in Europe, including country-specific estimates and legal insights into the outdated EU Directive 2002/58.

Europeans Spend 575 Million Hours Clicking Cookie Banners Every Year

Article 5 GDPR: 7 principles + €746M Amazon case + Meta €1.2B + CNIL/AEPD enforcement 2025. Side-by-side with CCPA, UK GDPR, LGPD.

7 Data Privacy Principles 2026: GDPR Article 5 + Sanctions

Ensure your business complies with GDPR by appointing an EU Representative. Our 2024 guide covers roles, responsibilities, and benefits for non-EU companies.

EU Representative GDPR Compliance Guide 2024

How to conduct a GDPR audit from scoping to remediation. Includes a 10-step checklist, document templates, and real enforcement examples.

GDPR Audit Guide: Step-by-Step Compliance Checklist

GDPR compliance guide 2026: the 10 obligations in order — lawful basis, ROPA, notices, rights, DPIA, processors, transfers, security, breach, retention.

GDPR Compliance Guide 2026: 10 Obligations, Step by Step

Art. 25 GDPR step-by-step: 7 principles + Notebooksbilliger €10.4M case + checklist for design phase + default settings + CNIL recent enforcement 2025.

Privacy by Design (Art. 25 GDPR): 7 Principles + Implementation

Is an IP address personal data under GDPR and CCPA? CJEU Breyer ruling, dynamic vs static IPs, and impact on analytics, logging, and cookie consent.

Is an IP Address Personal Data? GDPR & CCPA Guide

Comprehensive guide to cyber privacy: definition, threats from AI and data brokers, IoT security, and practical defense strategies for your digital rights.

Cyber privacy definition a clear and simple guide

Practical guide to applying GDPR data protection principles: actionable strategies for each of the seven Article 5 requirements.

How to apply the data protection principles effectively

12 GDPR consent examples: cookie banner, newsletter, marketing, profiling and special category wording, CNIL and AEPD tested, plus the fines you avoid.

GDPR Consent Examples 2026: 12 Copy-Paste Wording Templates

A practical GDPR compliance checklist covering all key requirements, from data mapping to breach response, so your organisation meets every obligation.

GDPR Compliance Checklist: Essential Guide for 2026

Core GDPR requirements every organisation must meet, from lawful processing and data subject rights to breach notification and accountability.

GDPR Requirements: What Every Organisation Must Do

Learn how to handle data subject access requests (DSARs) under GDPR — from receiving the request to responding within the legal deadline, with practical steps.

Data Subject Access Requests: A Practical GDPR Guide

A step-by-step guide to conducting a Data Protection Impact Assessment (DPIA) under GDPR Article 35 — when required, what to include, and how to document it.

Data Protection Impact Assessment: GDPR Guide

Understand the GDPR right to erasure (right to be forgotten) under Article 17 — when it applies, the exceptions, and how to handle deletion requests properly.

Right to Erasure Under GDPR: What You Need to Know

Practical guide to GDPR right of access under Article 15 — what individuals can request, what to disclose, and how to respond compliantly.

Right of Access Under GDPR (Article 15) Explained

Learn when legitimate interest applies as a lawful basis under GDPR Article 6(1)(f), how to conduct the three-part balancing test, and common mistakes to avoid.

GDPR Legitimate Interest: When and How to Use It

Understand how GDPR fines are calculated, see the largest penalties to date, and learn what steps your organisation should take to reduce enforcement risk.

GDPR Fines Explained: Penalties, Examples, and How to Avoid Them

Learn how to comply with GDPR step by step — from data auditing and legal bases to breach response and ongoing monitoring.

How to Comply with GDPR: A Step-by-Step Guide

Side-by-side comparison of GDPR and CCPA covering scope, consumer rights, consent rules, penalties, and compliance.

GDPR vs CCPA: Key Differences Every Business Should Know

Learn how GDPR data breach notification works, the 72-hour reporting rule, what to include, and how to avoid regulatory penalties.

GDPR Data Breach Notification: The 72-Hour Rule

Step-by-step guide to writing a GDPR-compliant privacy policy, covering mandatory content, transparency requirements, and common mistakes to avoid.

How to Write a GDPR-Compliant Privacy Policy

Honest review of AI Act compliance software in 2026: governance platforms, risk tools, bias testing, and where the market actually stands.

AI Act Compliance Tools: What Exists Today (2026)

Complete guide to AI Act high-risk AI systems obligations: Annex III categories, six core requirements, conformity assessment, CE marking, and GDPR interactions.

AI Act High-Risk AI Systems: Full Obligations List

Learn how the EU AI Act risk classification works across four tiers, from banned practices to minimal risk, and determine where your AI system falls.

AI Act Risk Classification: Where Does Your System Fall?

AI Act vs GDPR compared: scope, risk approach, enforcement, overlap on transparency, DPIAs, and automated decisions. Practical dual-compliance guidance.

AI Act vs GDPR: Data Protection Meets AI Regulation

A practical review of privacy-workflow scope, evidence, implementation and procurement questions.

Best GDPR Compliance Software: 6 Tools Compared + Pricing 2026

An independent comparison of six leading consent management platforms for 2026, covering GDPR compliance, TCF 2.2 support, Google Consent Mode v2, pricing, and which CMP fits each use case.

Consent Management Platforms Compared (2026)

Step-by-step guide to conducting a GDPR-compliant cookie audit. Covers discovery, classification, documentation, gap analysis, and ongoing monitoring.

Cookie Audit: How to Map Your Website's Cookies

Most cookie banners fail legal requirements. Learn what ePrivacy and GDPR demand, which dark patterns are illegal, and how to test your banner for compliance.

Cookie Banner Compliance: What Actually Meets the Law

Cookie consent under GDPR and ePrivacy: legal framework, valid consent rules, cookie categories, enforcement fines, and compliance checklist.

Cookie Consent Under GDPR and ePrivacy: Complete Guide

Complete guide to GDPR data processing agreements: mandatory clauses, sub-processor rules, audit rights, and enforcement examples under Article 28.

Data Processing Agreements Under GDPR: Complete Guide

Step-by-step guide to conducting a Data Protection Impact Assessment under GDPR Article 35, with triggers, methodology, and enforcement examples.

DPIA Under GDPR: Step-by-Step Implementation Guide

DORA compliance for banks: TLPT requirements, Register of Information, board-level ICT governance, incident reporting, and an ongoing compliance roadmap.

DORA for Banks: Obligations and Roadmap

A complete guide to DORA compliance covering the five pillars, 21 entity types in scope, penalties, and how it relates to GDPR obligations.

DORA Compliance: Complete Guide for Financial Entities

Best DORA Compliance Software: 6 Tools Compared + Pricing 2026

A detailed breakdown of DORA ICT risk management requirements under Articles 5-16, covering governance, framework components, documentation, and the simplified regime for micro-enterprises.

DORA ICT Risk Management Framework Explained

A detailed guide to DORA incident reporting under Articles 17-23, covering classification criteria, three-stage reporting timelines, competent authorities, and how it differs from GDPR breach notification.

DORA Incident Reporting: Timelines and Requirements

DORA non-compliance exposes fintechs to penalties up to 2% of global turnover, personal liability, and loss of authorization. Here is what is at stake.

The Real Cost of DORA Non-Compliance for Fintechs

Overview of DORA penalties for financial entities, ICT providers, and individuals. Enforcement authorities, timelines, and comparison with GDPR and NIS2 fines.

DORA Penalties and Enforcement: What to Expect

Guide to the DORA Register of Information required under Article 28(3), covering the ITS template with five relational tables, annual submission, and practical tips.

DORA Register of Information: Template and Guide

Complete guide to DORA resilience testing under Articles 24-27, covering basic testing for all entities, advanced TLPT requirements, TIBER-EU alignment, and the proportionality principle.

DORA Resilience Testing and TLPT Requirements

Guide to DORA third party risk management: mandatory contractual clauses, Register of Information, exit strategies, and ESA oversight of critical providers.

DORA Third-Party ICT Risk Management Obligations

Side-by-side DORA vs GDPR overlap analysis: incident reporting, third-party management, risk frameworks, and a practical dual-compliance roadmap.

DORA vs GDPR: Complete Overlap Analysis

A practical guide to EU AI Act compliance in 2026 covering risk categories, high-risk obligations, GPAI rules, timelines, and GDPR intersections.

EU AI Act: Practical Compliance Guide for 2026

Map the overlapping EU compliance stack in 2026: GDPR, DORA, NIS2, AI Act, and CRA obligations, with a practical framework for multi-regulation management.

EU Compliance Stack 2026: GDPR + DORA + NIS2 + AI Act

Detailed breakdown of GDPR compliance costs by company size, from micro-enterprises to large corporations. Compare DIY, consultant, and software approaches.

GDPR Compliance Cost: What Companies Actually Spend

A step-by-step playbook for GDPR data breach notification within 72 hours, covering risk assessment, authority reporting, and subject communication.

GDPR Data Breach Response: The 72-Hour Playbook

A practical guide to GDPR legitimate interest under Article 6(1)(f), covering the three-part test, LIA documentation, and real enforcement cases.

How to align DORA, NIS2, and GDPR incident reporting obligations with a unified response framework, side-by-side timelines, and notification authority mapping.

Incident Reporting: Aligning DORA, NIS2, and GDPR

Legiscope vs OneTrust: Which Fits Mid-Market?

A manual DPA audit costs EUR 10,400-16,000 and 130-200 hours per year. See the full cost breakdown and how automation cuts DPA review time by 98%.

Manual vs Automated DPA Audit: 140 Hours Wasted

Manual ROPA creation costs EUR 16,000-21,000 and 200-265 hours. See the full cost breakdown and how automation delivers 5-17x ROI in year one.

How Much Does Manual ROPA Creation Actually Cost?

Complete guide to NIS2 compliance requirements in 2026, covering scope, obligations, penalties, and how the directive interacts with GDPR and DORA.

NIS2 Directive: Complete Compliance Guide (2026)

Best NIS2 Compliance Software: 5 Tools Compared + Pricing 2026

Learn how NIS2 classifies essential and important entities, which sectors fall under each category, size thresholds, and how obligations and penalties differ.

NIS2 Essential vs Important Entities Explained

NIS2 incident reporting requires a 24-hour early warning, 72-hour notification, and 1-month final report. Complete guide to Article 23 obligations and timelines.

NIS2 Incident Reporting: The 24h/72h Framework

NIS2 Article 21 requires 10 cybersecurity risk management measures. Breakdown of each requirement, board liability, and overlap with GDPR and ISO 27001.

Search Legiscope