GDPR Records of Processing Activities (ROPAs) Explained: A Practical Guide to Article 30

A practical guide to GDPR Records of Processing Activities (ROPAs), explaining Article 30 requirements for controllers and processors, the limited small-business exemption, what a ROPA should contain, and how data mapping and documentation support accountability and compliance.

Controller-to-Processor Transfers: What Article 28 GDPR Requires

A practical guide to Article 28 GDPR requirements for controller-to-processor relationships, covering mandatory contracts, processor due diligence, required terms, sub-processor authorization, liability, security, oversight, and the distinction from international data transfer rules.

Data Protection by Design and by Default Under the GDPR: What Article 25 Requires

Learn what data protection by design and by default means under Article 25 GDPR, including privacy-protective defaults, data minimization, risk-based safeguards, accountability, DPIAs, processor selection, and how organizations can build data protection into systems from the start.

From Privacy by Design to Data Protection by Design: Principles and Practical Implementation

Privacy by Design embeds privacy into products, services, and business practices from the start. Explore its seven foundational principles, how they shaped Data Protection by Design under the GDPR, and practical steps organizations can take to turn privacy principles into everyday practice.

GDPR Certifications: Demonstrating Data Protection Compliance

Explore GDPR certification under Articles 42 and 43: how voluntary certification schemes help organizations demonstrate compliance, strengthen transparency and accountability, build trust, support international data transfers, and provide independent evidence of sound data protection practices.

GDPR and the CCPA: Testimony Before the California Senate Judiciary Committee

A look back at my 2019 testimony before the California Senate Judiciary Committee, explaining the GDPR, its historical foundations and core principles, and how Europe’s approach to data protection compared with California’s newly enacted CCPA.

What is the "Right to an Explanation" under the GDPR?

The GDPR gives individuals important rights when organizations rely on automated decision-making and profiling. Learn when Article 22 applies, the safeguards organizations must implement, and how individuals can challenge automated decisions.

What is the "Right to Object" under the GDPR?

The GDPR's Right to Object allows individuals to stop certain uses of their personal data, particularly for direct marketing. Learn when the right applies, how organizations must respond, when objections may be refused, and the role of Legitimate Interests Assessments (LIAs).

What is the "Right to Data Portability" under the GDPR?

The GDPR's right to data portability allows individuals to obtain certain personal data they have provided to an organization and transfer it to another service. This article explains Article 20 GDPR, when the right applies, obligations, exceptions, and practical compliance tips.

What is the "Right of Access" under the GDPR?

The GDPR's right of access empowers individuals to obtain a copy of their personal data and understand how it is being used. This article explains Article 15, Subject Access Requests (SARs), response deadlines, exceptions, best practices, and practical compliance guidance for organizations.