Tag
Privacy
33 articles
Privacy
UK GDPR vs EU GDPR: the differences that matter
Where UK GDPR and EU GDPR now differ in practice: regulators, representatives, transfer tools, the Data (Use and Access) Act 2025, and what stays shared.
6 min read
AI governance
Shadow AI: finding the tools your teams already use
Where to look for unapproved AI tools: identity grants, expenses, browser extensions, network logs, features in existing SaaS, code. Then how to triage.
6 min read
Privacy
Managing sub-processors and the notice customers expect
What GDPR Article 28 requires for sub-processors, who counts as one, how to run the list and change notices, and what to do when a customer objects to a change.
6 min read
Privacy
Controller vs processor: which one are you?
How to tell whether you are a GDPR controller or processor for each activity, why most SaaS companies are both, and what each role obliges you to do.
6 min read
Privacy
Building a data retention schedule
How to build a data retention schedule that works: the fields each entry needs, choosing trigger events, handling backups and legal holds, and proving deletion.
6 min read
Privacy
Data minimization in product design
How to apply data minimization while a feature is being designed: field-level purpose checks, logs, analytics, test data, and the evidence it happened.
6 min read
Privacy
Cookie consent under GDPR and ePrivacy
Why cookie consent rests on the ePrivacy Directive, what the GDPR adds, how narrow the strictly necessary exemption is, and how to test your banner.
6 min read
Audit readiness
How long to keep audit evidence
What SOC 2, ISO 27001, HIPAA and PCI DSS say about keeping evidence, what the audit cycle implies, and why privacy law limits how long you should keep it.
6 min read
Compliance frameworks
FERPA vs COPPA for EdTech companies
FERPA regulates schools and COPPA regulates operators. How the two laws differ, when both apply to one product, and how school authorization fits between them.
6 min read
Privacy
GDPR for US SaaS companies
When the GDPR reaches a US SaaS company, the controller and processor roles you hold, and the obligations to put in place first, in a practical order.
6 min read
Compliance frameworks
Student data privacy agreements, explained
What a student data privacy agreement contains, why districts require one, how standardized agreements work, and which clauses need operational work first.
6 min read
Compliance frameworks
The HIPAA minimum necessary standard
What HIPAA's minimum necessary standard requires for uses, disclosures and requests of PHI, where it does not apply, and how a SaaS vendor designs for it.
6 min read
Privacy
Privacy by design under GDPR Article 25
What GDPR Article 25 requires of data protection by design and by default, how the EDPB reads it, and how to build evidence of it into your development work.
6 min read
Compliance frameworks
The FERPA school official exception
The three conditions a vendor must meet to receive student data as a FERPA school official, what direct control means for SaaS, and the redisclosure rules.
6 min read
Privacy
Do you need a data protection officer?
The three Article 37 tests for a mandatory DPO, what core activities and large scale mean, who can hold the role, and how to record a decision not to appoint.
7 min read
Compliance frameworks
PHI vs ePHI: what counts as protected health information
How HIPAA defines PHI and ePHI, why the holder matters as much as the data, what the definitions exclude, and how to classify the edge cases SaaS teams hit.
6 min read
AI governance
AI vendor risk: questions to ask before you adopt a model
The questions to add to vendor due diligence before adopting an AI model or AI feature: data use, retention, hosting, model changes, incidents, contracts.
6 min read
Privacy
GDPR breach notification and the 72-hour clock
When the GDPR's 72-hour breach clock starts, what an Article 33 notice must contain, when to tell individuals, and how processors fit into the timeline.
7 min read
Compliance frameworks
FERPA for EdTech vendors
FERPA regulates schools, not vendors, yet it shapes every EdTech contract. How it reaches you, what counts as an education record, and the controls to run.
6 min read
Privacy
Handling data subject access requests on time
How to answer a GDPR access request within one month: the deadline rules, proportionate identity checks, what the response must contain, and the records.
6 min read
Compliance frameworks
What an ISO 27701 certification audit involves
How an ISO 27701 certification audit runs: choosing a certification body, stage 1 and stage 2, what gets sampled, nonconformities, and surveillance.
6 min read
Privacy
Transfer impact assessments after Schrems II
What a transfer impact assessment must show after Schrems II, the EDPB's six steps, how the Data Privacy Framework changes US transfers, and what to record.
6 min read
Compliance frameworks
The SOC 2 privacy criterion compared with GDPR
How the SOC 2 privacy criteria P1 to P8 line up against GDPR, where they overlap, what GDPR requires that SOC 2 never tests, and when to include privacy.
6 min read
Compliance frameworks
Building a privacy information management system on your ISMS
A step-by-step plan for extending an ISO 27001 ISMS into an ISO 27701 PIMS: roles, scope, privacy risk, controls, and the management review changes.
6 min read