Register of Information: What DORA Article 28(3) Requires
DORA's register of information carries four obligations, and the forward-looking ones get missed. All arrangements, prescribed templates, and…
Read More
Data Protection Officer: When Article 37 Makes One Mandatory
A DPO is mandatory in three cases, and all of them turn on core activities. What Article 38…
Read More
International Data Transfers: Chapter V in Priority Order
GDPR Chapter V has a strict order: adequacy, then safeguards, then situational derogations. Why the last route is…
Read More
Data Subject Access Request: The Copy Is Only Half of It
Article 15 asks for the data plus eight further items. The extension you must claim inside month one,…
Read More
Breach Notification: Two Thresholds, Two Clocks
GDPR breach notification is not one 72-hour rule. Two thresholds, two audiences, phased notification, and the log you…
Read More
Legitimate Interests Assessment: The Test and the Trap
A legitimate interests assessment has three parts, one hard exclusion, and an Article 21 consequence most teams miss…
Read More