ROPA Exemption: The Essential 2026 Guide to GDPR Article 30(5) for Small Organizations
Does a small organization need a record of processing activities? The ROPA exemption in GDPR Article 30(5), the…
Read More
Legitimate Interests Right to Object: The Essential 2026 Guide to GDPR Article 21
What happens when someone objects to processing based on legitimate interests: the Article 21 test, the absolute marketing…
Read More
ISO 27001 Risk Assessment Methodology: The Essential 2026 Guide to Choosing an Approach
How to define an ISO 27001 risk assessment methodology: what clause 6.1.2 requires, asset-based versus event-based approaches and…
Read More
Risk Heat Map: The Essential 2026 Guide to Building a 5×5 Matrix Executives Trust
How to build a risk heat map: define 5x5 likelihood and impact scales, set colour bands from risk…
Read More
DPIA Prior Consultation: The Essential 2026 Guide to GDPR Article 36
When a DPIA leaves high residual risk, GDPR Article 36 requires prior consultation. Learn the trigger, the submission…
Read More
Business Impact Analysis Report: The Essential 2026 Guide to Structure and Findings
How to structure a business impact analysis report for ISO 22301: nine sections, clear findings, the recovery sequence…
Read More
Business Continuity Risk Register: The Essential 2026 Guide with 12 Fields
A practical guide to building a business continuity risk register for ISO 22301: the 12 fields, BIA-linked scoring,…
Read More
AI Risk Treatment Plan: The Essential 2026 Guide to ISO 42001 Clause 6.1.3
How to build an AI risk treatment plan under ISO 42001 clause 6.1.3: options, columns, Annex A links…
Read More
ISO 42001 Impact Assessment: The Essential 2026 Guide to Clauses 6.1.4 and 8.4
How the ISO 42001 impact assessment works: clause 6.1.4, clause 8.4, Annex A.5, and the evidence auditors ask…
Read More
ROPA Example: A Complete 2026 Worked Record of Processing Activities
A ROPA example for a fictional 320-person delivery company: controller details, the exemption check, three activities in full,…
Read More
Controller vs Processor ROPA: The Essential 2026 Guide to Both Records
Controller vs processor ROPA: what Article 30(1) and 30(2) each require, a side-by-side comparison, which record an activity…
Read More
GDPR Data Mapping: The Complete 2026 Guide From Systems to ROPA
GDPR data mapping explained: what to capture, how a data map differs from the records of processing, a…
Read More