Blog: EU Privacy Laws
Page 1
GDPR Article 30: How to Create Your Record of Processing Activities
A Record of Processing Activities, or ROPA, is a written document that lists every way your business collects, uses, stores, shares, and protects personal data. Under Article 30 of the GDPR, almost every company operating in or targeting the EU needs one, whether you have 250 employees or just five. Article...
Vendor Management for GDPR: How to Audit Your Third-Party Tools
Organizations that rely on third-party tools to handle personal data should audit vendors to meet the European Union's (EU) General Data Protection Regulation (GDPR) requirements. This article explains what the GDPR is, why organizations are liable for vendor noncompliance, and how to conduct a GDPR vendor audit to reduce compliance risk. What...
The Rise of Class Actions in Data Protection: What Companies Should Expect
Class action lawsuits are on the rise, and laws such as the European Union's (EU) Directive 2020/1828 make it easier for consumers to bring collective action against companies that breach EU privacy and data protection laws. This article explains what data protection class actions are, the role of Directive 2020/1828, common...
What to Do When You Receive a DSR via Third Party (Like Privacy Tools or Brokers)
Responding to a data subject request (DSR) has become a routine obligation under privacy laws like the GDPR and the CCPA/CPRA. But when those requests come through third parties or privacy tools, it often raises questions about how to handle verification correctly. While most privacy laws allow third parties to act...
Identity Verification Standards Under GDPR vs. CCPA/CPRA
If your business collects customer data, you're probably familiar with data subject (customer) requests. They often run along the lines of "I want to see the data you hold on me," or "I want you to delete everything you have on me." These requests are common, and it's your job to...
Building a Redaction Policy: What Every Company Should Document Before Processing Requests
When an employee, customer, or regulator asks your company for information, how you respond can have serious legal and reputational consequences. Whether it's a Data Subject Access Request (DSAR) under privacy laws, an eDiscovery process in litigation, or an HR audit, your organization may need to share documents that contain...