Editor

Is Employee Monitoring Software Legal Under GDPR? Rules for Remote Teams Employee monitoring software can be legal under GDPR, but only under specific conditions. The problem is that most monitoring tools employers buy off the shelf are configured by default to break those conditions. The default settings on commercial monitoring software are built for maximum […]

How to Write a Privacy Notice That Meets GDPR Requirements If you’re collecting personal data, whether through a signup form, cookie banner, or checkout page, GDPR requires you to disclose what you’re doing with it before or at the point of collection, using a privacy notice. Confusing this with your general privacy policy, or missing

Do Abandoned Cart Emails Require Consent Under GDPR? Abandoned cart emails sit in a legal grey area under GDPR. But to answer the question: it depends on how you collected the email address and what legal basis you’re relying on. If the customer gave their email address during the checkout process but didn’t complete the

7 Privacy Policy Mistakes That Are Getting Businesses Fined On 21 January 2019, France’s data protection authority fined Google €50 million. No servers were breached, and no user data was stolen. Investigators had simply followed the steps a new Android user would take when setting up their phone and creating a Google account. To find

GDPR Right to Erasure: How to Handle Deletion Requests (and When You Can Refuse) Most deletion requests are straightforward. Someone closes an account, asks you to remove their data, and you do. The complexity arrives when the data can’t be deleted, or legally shouldn’t be. The GDPR right to erasure, enshrined in Article 17, is

GDPR Cookie Consent: What Your Banner Must Do to Be Compliant Most cookie banners are legal theatre. They perform compliance while systematically nudging users toward acceptance, and European regulators have grown tired of the act. GDPR cookie consent has always carried teeth, but enforcement in 2026 looks nothing like the cautious early years of the

Ransomware and GDPR: What You Must Do When an Attack Hits Ransomware doesn’t just lock your files; under GDPR, it starts a clock. From the moment you discover a ransomware attack, you have 72 hours to assess whether personal data has been compromised and, if it has, notify your supervisory authority. Miss that window, and

Why Organisations Fail the GDPR 72-Hour Breach Notification Rule Nobody plans to mishandle a data breach. But when one happens, there is usually a lot of pressure, and the information is almost never complete. In most cases, the systems are down, the security team is still trying to understand what happened, and at the same