News and updates
New implementing decisions, guidelines and positions from supervisory authorities — and what they mean in practice.
Can I handle a data breach myself?
Assessing and managing a data breach can largely be done yourself, provided you follow the GDPR steps and document what you have done; if in doubt or facing a complex situation, seeking advice is wise.
Read more →Data subject requests: what is changing this year?
The rights of customers and employees to access or delete data have been established in the GDPR for years, but how companies handle these requests is shifting. This article outlines what remains stable and what is changing in practice.
Read more →What is the most common mistake when using AI tools in the workplace?
The most common mistake is that employees paste personal data into an AI tool without the company knowing which tool it is, what happens to the data, or whether a processor agreement is in place. This article explains what goes wrong and how you can prevent it.
Read more →What documents do you need for a data subject access or deletion request?
An overview of the documents you need to properly handle a data subject access or deletion request, with special attention to the identification issue that most often goes wrong in this context.
Read more →How long does it take to process a rectification request or an objection?
A request to correct data or an objection to processing has the same one-month deadline as a data access request, but in practice it gets stuck at different points. This article shows exactly when the clock starts and where organizations lose time.
Read more →What does handling a data breach cost your company?
The costs of a data breach are not in the reporting itself, but in the time, investigation, and measures that follow. This article shows where those costs come from and what determines their extent.
Read more →Does GDPR apply to business contact details of customers and suppliers?
Many entrepreneurs think that GDPR only concerns consumer data. This article explains when business contact details do fall under GDPR and what that means in practice.
Read more →What is a data subject request and what must you do with it?
A data subject request is not just a formal access or deletion request: it can also be a casual email or phone call. This article explains what rights come with it and why recognition is often the biggest bottleneck.
Read more →What happens if I don't make my new website or webshop GDPR-compliant?
Anyone launching a new website or webshop without sorting out the GDPR side runs into practical problems: from complaints by visitors to questions you can't answer. This article sets out the consequences straightforwardly.
Read more →Online shop with customers abroad: what is different according to the GDPR?
The GDPR applies in the entire EU/EEA in the same way, but around cookies, language, supervision and data outside Europe the rules diverge. This article sets out exactly where the difference lies.
Read more →Can I make a new website or webshop GDPR-compliant myself?
You can usually draw up a privacy statement and configure cookies yourself; data processing agreements with hosting and analytics partners require more attention. This article shows where the line between doing it yourself and outsourcing lies.
Read more →Data breaches and the breach notification obligation: what changes this year?
The 72-hour deadline from the GDPR itself is fixed, but the way supervisory authorities and related legislation view it is shifting. This article sets out what does and does not change for the breach notification obligation this year.
Read more →What is the most common mistake when handling a data subject access request or deletion request?
The most common mistake in handling a data subject access request or deletion request is not the deadline, but misjudging what exactly must be deleted or disclosed. This article shows where things go wrong and how you can prevent it.
Read more →What documents do you need for a new website or webshop?
When you launch a new website or webshop, you typically bring on a whole series of new data processors at once. This overview shows which documents belong together and why you need more than one.
Read more →How long does it take to make a new website or web shop GDPR-compliant?
The timeframe varies widely: a simple brochure website is often sorted within a day, while a web shop with multiple tools can take several weeks. This article shows where the time goes and where things often get stuck.
Read more →What does it cost to make a new website or web shop GDPR-compliant?
Making a new website or web shop GDPR-compliant does not come with a fixed amount: the costs depend on how many tools you connect, whether you draft documents yourself, and how much data you collect through the site.
Read more →Does the GDPR apply to my new website or webshop?
As soon as a website or webshop processes personal data — via a contact form, analytics or a checkout process — the GDPR applies. This article explains when that is the case and what it concretely means for you.
Read more →What is a DPIA and when must you conduct one?
A DPIA is a mandatory risk assessment before you begin processing that carries significant risk for the individuals involved. This article explains when this obligation applies to SMBs and what such an assessment should contain.
Read more →What happens if you don't have a privacy notice on your website?
Without a privacy notice, you lack evidence that you inform visitors about their data — with consequences that go far beyond a fine from a regulator.
Read more →Data Processor Agreement with a supplier outside the EU: what is different?
If your SaaS supplier is located outside the EU or the EEA, the data processor agreement remains the same in substance, but an additional layer of rules applies regarding the transfer of data to that country.
Read more →Can I demonstrate privacy compliance myself for a tender or insurance company?
An entrepreneur can often prepare part of demonstrating privacy policy themselves; where oversight and substantiation become more complex, that is where outsourcing makes sense.
Read more →Data Processing Agreement: what changes this year?
The core rules for the data processing agreement have been established in the GDPR for years, but the practice around it is shifting: new sub-processors, revised transfer rules and additional guidelines. This article explains what that concretely means for your existing agreements.
Read more →What is the most common mistake when reviewing a data processing agreement?
Companies often sign a data processing agreement without checking who has which role and what happens to the data after the contract ends. This is the mistake that occurs most frequently, and the easiest to prevent.
Read more →What documents does an insurer ask for when you want to take out cyber insurance?
An insurer offering cyber insurance almost always asks for proof that you have control over personal data and security. This article lists which documents usually come up and why a fixed, mandatory list does not exist.
Read more →How long does it take to set up a processing register?
Setting up a processing register typically costs a small business a few hours to a couple of days of work, spread over several weeks — the delay is almost always in finding out exactly which tools and vendors are being used.
Read more →What does a data processing agreement cost your business?
The price of a data processing agreement ranges from free to a few thousand euros; this article explains where that amount comes from and what determines it.
Read more →Does the GDPR apply if your company uses ChatGPT or other AI tools?
The GDPR applies not because you use an AI tool, but because you may be processing personal data in doing so. This article explains when that is and is not the case.
Read more →How long can I keep camera footage from my business?
For camera monitoring on the work floor or in a shop, there is no fixed legal retention period, but the Data Protection Authority applies a strict principle that surprises most entrepreneurs.
Read more →What happens if I don't respond to a data subject access or deletion request on time?
The GDPR does not specify a fine for missing a deadline, but it does describe what can happen: the data subject can appeal to the supervisory authority or to a court. This article explains what this deadline entails and what you can do if you're at risk of missing it.
Read more →Data breach at an establishment outside your home country: which supervisor is competent?
Does your company have an establishment in another EU country and does a data breach affect individuals in multiple countries? This article explains which supervisor then takes the lead and what does and does not change.
Read more →Can I maintain my record of processing activities myself?
The GDPR does not prescribe a tool: you may keep a record of processing activities yourself, provided it remains complete and up to date. This article shows where doing it yourself works and where it becomes difficult.
Read more →What changes this year for the SaaS tools your business uses under the GDPR?
The GDPR itself does not change, but the tools you use daily do: new features and updated processor agreements occasionally call for a fresh look at existing arrangements.
Read more →What is the most common mistake when maintaining a records of processing activities?
Most records don't go wrong in the initial setup, but in the upkeep: they are filled in once and then become disconnected from reality. This article shows which mistakes keep recurring and how to prevent them.
Read more →Which documents do you need in case of a data breach?
When a potential data breach occurs, it is not only about notification to the Data Protection Authority: even without that notification, you must document the incident internally. This is the list of documents, and why that internal record is most often overlooked.
Read more →How long does it take to process a deletion request?
The GDPR allows one month to process a deletion request, with a possible extension of two months in complex cases. This article explains when that deadline begins and what is and is not included.
Read more →What does a processing record cost for SMEs?
An overview of what a processing record costs: from maintaining it yourself with a template to a subscription or legal advice, and what ultimately determines the price.
Read more →Does the GDPR apply to my business if I have no employees?
Many freelancers and small business owners think that the GDPR only applies to large companies. This article explains which factor actually determines whether the law applies to you.
Read more →How long may I retain application data from rejected candidates?
A concrete explanation of the retention period for CVs, cover letters and interview records of candidates who were not hired, and when a longer period is permitted.
Read more →What happens if I don't report a data breach to the data protection authority on time?
A straightforward explanation of what follows when a data breach report is late or doesn't happen at all: what the GDPR requires on this point and what that can mean in practice.
Read more →Camera surveillance at a location abroad: do the same rules apply as in the Netherlands?
The GDPR applies in all EU countries, but for camera surveillance and other employee data, the regulation deliberately leaves room for individual national rules. If you also have staff in Germany, Belgium or another EU country, it is advisable to know those differences.
Read more →Can I draft a data processing agreement myself?
The GDPR does not prescribe a fixed format, so you can draft your own — but there are mandatory components that must be included, and a threshold beyond which legal advice becomes more prudent.
Read more →What changes are there this year in the rules for AI in the workplace?
The European AI Act is coming into force step by step and affects companies that use AI tools for personnel, customer contact or monitoring. This article explains what that means alongside existing GDPR obligations.
Read more →What is the most common mistake when reporting a data breach?
The most common mistake is not the data breach itself, but waiting to report until all facts are established — which means the statutory 72-hour deadline has already largely elapsed before the report is made.
Read more →Which documents do you need to demonstrate data protection compliance to a contracting authority or insurer?
A contracting authority or insurer increasingly asks you to demonstrate that you have control over personal data. This article lists which documents belong to that and why simply ticking off a simple checklist is not enough.
Read more →How long does it take to process an access request?
The GDPR sets a fixed deadline for responding to a request from a data subject, with the possibility of an extension in more complex cases. In practice, that deadline often comes down to identification and scattered data.
Read more →What does a privacy statement for your website cost?
A privacy notice does not need to cost anything if you draft it yourself, but what you pay once you purchase customization or legal review depends on how much data and tools your business uses.
Read more →Do I need to maintain a processing register as a small business?
The GDPR applies to virtually every organization that processes personal data, including sole proprietors and small businesses. There is an exception to the register obligation, but in practice it rarely applies fully.
Read more →What is a data processing agreement and when do you need one?
A processor agreement regulates who is responsible when another company processes personal data on your behalf. This article explains when you need one and what it should contain.
Read more →Are you looking for reliable support with your data protection matters? GDPRIA helps entrepreneurs and organizations implement and manage their data protection correctly. On this news page you will find the latest updates, practical tips and relevant information about data protection legislation, GDPR compliance and data security.
Data protection is not a one-time task. Regulations evolve continuously, new risks emerge and your organization grows. GDPRIA ensures you stay informed of changes that matter to your business. We share insights into new GDPR guidelines, regulatory announcements from authorities and industry best practices.
Many small and medium-sized businesses struggle with the same challenges: which data may I retain? How do I ensure proper consent? What should I do in case of a data breach? We answer these questions regularly in our news articles. You receive practical guidance that you can apply directly in your business operations.
On this page you will also find information on legal obligations, such as appointing a data protection officer, conducting data protection impact assessments and drawing up data processing agreements. Our articles help you understand what the regulations require of you and how to organize that efficiently.
GDPRIA not only provides you with answers, but builds a long-term relationship. We track your progress, advise where necessary and adapt to your organization's specific situation. Thanks to our support, you can focus on what you do best: running your business.
Keep an eye on this page for new articles, changes in data protection laws and tips to further improve your data protection.