Featured posts
Digital Omnibus
20-21 Oct: 🔥 Timeline update from noyb and Council agreed their position on GDPR and ePrivacy changes:
Events 2026
Next up: 21-23 Oct 🇩🇰 Copenhagen: ITechLaw 2026 European Conference I 22-23 Oct 🇳🇴 Sandefjord: Det årlige personvernkurset
Right of access (DSARs)
All things right of access: Article 15 elements table, a handy flowchart, key CJEU rulings and Rie's practical guide.
Data protection impact assessments – DPIAs
Key resources for data protection impact assessment – DPIAs. Latest: EDPB shares new DPIA template (it's excessive)...
DPO role key resources
Key DPO role resources: CJEU rulings, EDPB/WP29 Guidelines, DPA guidance and more.
Lawfulness: Consent
When can you rely on consent as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
Lawfulness: Legitimate interest
When can you rely on legitimate interest as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
The DPO role: Article 37(1)(b)
Breaking down Article 37(1)(b) key terms: 'core activities', 'regular', 'systematic', 'monitoring' and 'large scale'. And what should you do if you're still unsure whether you need to appoint a DPO? Appoint one voluntarily?
Member memos
paid
–
32 min read
Important update: Member memos have moved to the DPO Hub Community (separate platform). If you’re not a member yet, reply to the last email update to request an invite, as the link isn’t shared publicly.
Access requests – in practice
paid
–
3 min read
Recommendations on how to deal with the Right of access – DSARs – in practice (with grumpy DSARs checklist).
EDPB meeting minutes 16 jan 2025
paid
–
1 min read
Anonymisation Guidelines coming (no date yet) | Revised DPO Guidelines due Q2 2026 | IAB Europe TC String 🇧🇪 national ruling due 19 March | New Support Pool of Experts report: AI bias and data subjects’ rights.
EDPB meeting minutes 17 Dec 2024
paid
–
1 min read
No big news - summary of their AI models Opinion discussion (where, interestingly, one EU member voted against adoption). You can safely skip this update.
EDPB CEF: Coordinated Enforcement Framework
paid
–
2 min read
2025 report ready | 2026 topic: 📝 transparency & information | The EDPB created the CEF initiative under its 2021-2023 Strategy to enhance enforcement and strengthen cooperation among DPAs. Each year, they collectively choose a priority enforcement topic for coordinated (voluntary) action.
Sweden DPA IMY: DPIA practical guidance
paid
–
1 min read
IMY has shared a DPIA guide, primarily for those with little or no experience. It sets out a clear 10-step process for conducting an "acceptable" DPIA, to be used alone or with their templates. Grab the documents here (Swedish and DeepL translation).
EDPB press release: AI enforcement task force, age assurance and WADA recommendations
paid
–
1 min read
EDPB sets up an AI enforcement task force with a "quick response team" and adopts recommendations for WADA's 2027 World Anti-Doping Code, along with a statement on age assurance.
Chief of Updates
