WHAT IS “PERSONAL INFORMATION” UNDER CCPA?

Learn how the CCPA defines personal information through its four statutory building blocks, including identifiers, inferences, household data, IP addresses, anonymous data, and key compliance considerations for businesses.

Convention 108 Explained: The International Treaty That Shaped Modern Data Protection

Convention 108 was the first binding international data protection treaty. Explore its origins, core principles, approach to transborder data flows, influence on European data protection law and the GDPR, and why its 1981 signing is commemorated each January 28 as Data Protection Day.

California v. Delta Air Lines: Why a Website Privacy Policy May Not Cover a Mobile App

California’s lawsuit against Delta Airlines shows why mobile apps need privacy policies that clearly address their data practices—and how federal preemption can limit state enforcement even when an app allegedly fails to comply with CalOPPA.

When “Aggregated” Isn’t Anonymous: The New York Attorney General Pushes the Boundaries of App Data Disclosures

The New York Attorney General’s Matis case shows that “aggregated” data is not necessarily anonymous. If a third party can de-aggregate and re-identify individuals, the sharing should be disclosed—and contracts should expressly prohibit re-identification.

Blockchain: Challenges and solutions for compliance with the GDPR

An overview of blockchain through the lens of the GDPR, examining territorial and material scope, data protection principles, controller and processor roles, lawful bases, data subject rights, cross-border transfers, and security challenges.

GDPR Data Breaches Explained: Security Incidents, Risk Assessment and Notification Requirements

A personal data breach can trigger significant obligations under the GDPR. Learn what constitutes a breach, how to assess risks to individuals, when the 72-hour notification rule applies, when affected individuals must be informed, and what organizations must document.

GDPR Data Security Explained: A Practical Guide to Technical and Organizational Measures

A practical guide to GDPR data security requirements, including risk assessments, technical and organizational measures, encryption, pseudonymization, resilience, processor oversight, staff training, authentication, and the ongoing testing needed to protect personal data.

The GDPR Data Protection Officer (DPO) Explained: When You Need One and What They Do

A practical guide to Data Protection Officers under the GDPR: when organizations must appoint a DPO, the qualifications and independence the role requires, key responsibilities, conflicts of interest, and how DPOs support effective data protection governance and accountability.

GDPR Codes of Conduct: How They Work and Why They Matter

Learn how GDPR Codes of Conduct turn data protection requirements into practical, sector-specific standards. Explore how codes are developed, approved and monitored, why organizations may choose to join them, and how they can support accountability, compliance and international data transfers.

The GDPR’s DPIA Requirement: Identifying, Assessing, and Mitigating High-Risk Processing

A practical guide to GDPR Data Protection Impact Assessments (DPIAs), explaining when they are required, the nine high-risk criteria, how to assess and mitigate risks, conduct a DPIA, document decisions, and determine when prior consultation is required.