Why Pay-Or-Okay remains under GDPR pressure
Pay-Or-Okay is not automatically unlawful, but it creates clear GDPR risks. Organisations should evaluate whether, and to what extent, consumers may feel…
From Ban to Design: How Do We Protect Children Online?
Australia's age limit of 16 for social media and France's failed attempt at similar rules revived debate on protecting children online. Age limits are…
Towards a single DPIA approach across the EU
The Digital Omnibus proposal and the EDPB’s draft DPIA template both point towards greater EU-wide alignment. This blog explains what may change, why the…
The Legal Fine Print of "Anonymous" Data
Effective July 1, 2026, prior consent will be required for commercial telemarketing. The soft opt-in for existing customers has been eliminated. Organizations…
Soft opt-in for telemarketing abolished
Effective July 1, 2026, prior consent will be required for commercial telemarketing. The soft opt-in for existing customers has been eliminated. Organizations…
EDPB Guidelines on Scientific Research
The EDPB’s Draft Guidelines clarify when research qualifies as genuinely scientific, how GDPR flexibilities apply and which safeguards organisations need.…
Article 88c GDPR: A New Route for AI Processing
Proposed Article 88c GDPR could give organisations more clarity on using legitimate interests for AI. It does not create a general AI exemption: existing…
Data Subject Access Requests Abuse Under the Digital Omnibus
Data subject access requests are increasingly used for purposes beyond data protection, such as litigation. This blog explains the Digital Omnibus proposal…
