Day: August 16, 2026

Clause 8.2 carries everything built on top of it, and 8.5 cannot be closed on paper. How to…

A gap analysis asks what is missing. A readiness assessment asks whether you would pass Stage 2 —…

The rule never says cookies and never says personal data. What Article 5(3) covers, the two exemptions read…

The 2026 Consolidated Rules do not define an authorization boundary. Scope now comes from the Minimum Assessment Scope…

The Framework Directive named work pace and social relationships as hazards in 1989. ISO 45003 is guidance on…

The UDI-DI and UDI-PI split, where carriers go and where they do not, the Basic UDI-DI on your…

Seven days to acknowledge, three months to give feedback, and a reversed burden of proof that makes every…

Scope, frequency derived from classification, segregation from the source system, RTOs that hold in extreme scenarios, and reconciliation…

Article 29 calls it a preliminary assessment, so it belongs in procurement. Substitutability, closely connected providers, insolvency law…

Pseudonymised data is still personal data. What Article 4(5) requires, and the Recital 26 test — singling out,…

Article 27 falls on deployers, not providers. Who owes a FRIA, the six required elements, the duty to…

Article 28(8) requires exit plans that are documented and tested, and Article 30(3)(f) requires a mandatory transition period…