Bridge Letter: What It Covers, and What It Does Not
A SOC 2 bridge letter is written by management, not the auditor, and nothing in it is tested.…
Read More
Complementary User Entity Controls: The Half You Must Do
A SOC 2 report lists controls the provider assumes you operate. Nobody tests them. How to extract, own…
Read More
Prohibited AI Practices: Article 5 Is Already In Force
The EU AI Act's eight prohibited AI practices have applied since 2 February 2025, with fines up to…
Read More
Third-Party Risk Management: One Inventory, Four Regimes
DORA, NIS2, ISO 27001 and sector schemes ask about the same suppliers in different formats. Build one inventory…
Read More
Register of Information: What DORA Article 28(3) Requires
DORA's register of information carries four obligations, and the forward-looking ones get missed. All arrangements, prescribed templates, and…
Read More
Data Protection Officer: When Article 37 Makes One Mandatory
A DPO is mandatory in three cases, and all of them turn on core activities. What Article 38…
Read More
International Data Transfers: Chapter V in Priority Order
GDPR Chapter V has a strict order: adequacy, then safeguards, then situational derogations. Why the last route is…
Read More
Data Subject Access Request: The Copy Is Only Half of It
Article 15 asks for the data plus eight further items. The extension you must claim inside month one,…
Read More
Breach Notification: Two Thresholds, Two Clocks
GDPR breach notification is not one 72-hour rule. Two thresholds, two audiences, phased notification, and the log you…
Read More
Legitimate Interests Assessment: The Test and the Trap
A legitimate interests assessment has three parts, one hard exclusion, and an Article 21 consequence most teams miss…
Read More
Records of Processing: Why the 250-Employee Exemption Fails
GDPR Article 30 records of processing: the exemption almost never applies, controllers and processors keep different records, and…
Read More
DPIA: What GDPR Article 35 Actually Requires
A DPIA has four mandatory elements and two of them get skipped. What Article 35 requires, when Article…
Read More