Your OSS for the EU-US DPF
paid
–
8 min read
EDPB shares updated DFP docs – added nuance on transfer of HR Data.
Featured posts
Digital Omnibus
20-21 Oct: 🔥 Timeline update from noyb and Council agreed their position on GDPR and ePrivacy changes:
Events 2026
Next up: 21-23 Oct 🇩🇰 Copenhagen: ITechLaw 2026 European Conference I 22-23 Oct 🇳🇴 Sandefjord: Det årlige personvernkurset
Right of access (DSARs)
All things right of access: Article 15 elements table, a handy flowchart, key CJEU rulings and Rie's practical guide.
Data protection impact assessments – DPIAs
Key resources for data protection impact assessment – DPIAs. Latest: EDPB shares new DPIA template (it's excessive)...
DPO role key resources
Key DPO role resources: CJEU rulings, EDPB/WP29 Guidelines, DPA guidance and more.
Lawfulness: Consent
When can you rely on consent as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
Lawfulness: Legitimate interest
When can you rely on legitimate interest as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
The DPO role: Article 37(1)(b)
Breaking down Article 37(1)(b) key terms: 'core activities', 'regular', 'systematic', 'monitoring' and 'large scale'. And what should you do if you're still unsure whether you need to appoint a DPO? Appoint one voluntarily?
Norway DPA orders Helseplattformen to rectify shortcomings
paid
–
3 min read
Weird DPA conclusion on controller's responsibility 🤔, will wait for the final decision | 🇳🇴 Datatilsynet notifies Helseplattformen of their intent to order fixes to serious organisational and (less serious) technical deficiencies.
Best of 2025 and what's coming in 2026
paid
–
1 min read
Enjoy the quiet period ahead to catch up on must-reads from 2025 and prepare for 2026.
EDPB Support Pool of Experts (SPE)
paid
–
6 min read
What is it, what have they spent (and spend) time and resources on, is it justified based on the current results, and should you apply? (Likely not.) Should you even spend time reading this post?
Adequacy decisions
paid
–
4 min read
On 26 Jan, 🇪🇺🇧🇷 COM & Brazil adopted mutual adequacy decisions, allowing businesses, public authorities and researchers to freely exchange data.
EDPB CEF 2025: Right to erasure (right to be forgotten)
paid
–
4 min read
💡 Should-read key takeaways for controllers from the final report. And do we need to sift through back-ups when we get an erasure request..?
EDPB Strategy and Work Programmes
paid
–
4 min read
💡 EDPB only to do a "targeted update" to DPO Guidelines | "Easing compliance is at the top of the EDPB agenda" – lets see how that plays out in practice.
noyb 🇦🇹 DPA Microsoft 365 Education complaints
paid
–
2 min read
[update – another win!] In 2024, noyb lodged two complaints against Microsoft's 365 Education platform on 1) lack of transparency and insufficient information, and 2) invasive and illegal cookie tracking of kids in schools. The Austrian DPA sided with noyb in both cases.
Chief of Updates
