I’ve spent years running large live events in Spain, and I keep hitting the same wall. Ticketing, cashless/RFID and POS systems generate huge amounts of attendee data. Most of it either sits unused or gets used in ways that wouldn’t survive a serious GDPR audit.

The approach I’ve landed on has three parts:

• Event operations run on contract as the legal basis
• Aggregate, cohort-level analytics run on legitimate interest, with a real opt-out
• Consent only for personalisation or sharing with third parties

Brands and artists never get raw fan contacts. Messages go out through the platform instead.

I’m also exploring an Article 40 code of conduct specifically for live events: festivals, stadiums, venues. Nothing like it exists yet as far as I can tell.

Questions for people doing this day to day:

1. Has your DPO accepted legitimate interest for event analytics, or do they insist on consent?
2. Would an industry code of conduct actually help you, or just add paperwork?

So I created a new tool to help privacy teams understand what their web sites are doing and also to help litigators explain privacy violations in Court.

This is a WebGL web app procedurally generated from the actual evidence logs from a forensic audit.

In my 20 years of working in privacy, I have seen in every client from startups to giant global enterprises - the privacy team have no idea what their web sites do because the marketing and dev teams hide it from them through obfuscated and minified code.

This tool now empowers privacy teams to see exactly what the code is doing, the relevant laws and regulations, regulatory guidelines etc.

It also makes it easier for litigators to question witnesses on the stand as they can visually point to a privacy event and ask them to explain it - as well as making it much easier to explain the code to the Jury and Judge.

Looking for a template or guidance to answer a DSAR and the details that should be in there. Are we supposed to list all systems and softwares?

Appreciate any help 🙏🏽

Hello guys,

I'm building OSS compliance agent to empower AI coding assessment like Claude Code, Cursor and Codex with MCP tools that helps them write code that privacy aware.

Currently added two GDPR/UAE PDPL and trying to cover more countries and region.

So now I'm looking for India personal data protection laws, what are the official website and where I can find it.

Also each law I published is added to the project as law pack, anyone can selects only laws that applied to his organization.

I also documented that how to contribute on law packs so by time we cover most of countries and regions.

The documentation is here:

https://github.com/alkhatibdev/dpolens/tree/main/packs

Currently I just need a the source I will add India PDPD my self, but anyone is welcomed if he/she would like to contribute.

Also if found useful please support us with your positive feedback and watch/star the project on Github

Is this something we can fight for? There few posts in Tour Du Mont Balnc community about scam messages (like this one Whatsapp message from Edelweiss : r/TourDuMontBlanc) where a lot of people who were using centralized booking platform: montourdumontblanc.com received messages on their phone numer containing a person's name, date and place of stay- which wouldn't be publicly available if not a personal data leak. I believe I was not the only one who fall for this scam- can we leverage GDPR laws to get some compensation from platforms?

Hello, we are looking to use an pseudonymizer service to use flagship AI models like Claude and ChatGPT.

It seems that www.anonimize.eu allows use to remove personal data on European servers/subprocessors and restore it after the result of a prompt.

Is this practical? Any experience with this?

Now our employees are just dumping documents in copilot since "its our environment"...

I am increasingly aware of the fact that modern internet is becoming extremely centralized and flooded with mass produced content - several big social networks capture disproportionate audience in my opinion. I consider small personal websites run by hobbyists to be a backbone of organic decentralized internet life and I've been wondering how privacy laws such as GDPR affect them.

Consider someone who wants to publish their own writing, art or some other creative work on a simple website with no intent to monetize it - no advertising, no user accounts, no analytics, etc. Just a static website hosted through a third-party provider with an email address so the visitors can get in touch. As I understand it, even this kind of website may fall under GDPR, since hosting provider processes visitors IP addresses and the operator may receive emails from the site visitors. If Article 13 applies, the operator is expected to disclose the identity of the data controller, which (again, if i understand correctly) potentially requires someone publishing under a pseudonym to reveal their real name.

What interests me is how this affects the independent web. If even a simple hobby website might involve legal notices, questions about data processing and disclosing personal information, that seems like an additional barrier to participation. I wonder this might also contribute to people choosing big centralized social media platforms instead of maintaining their own websites.

I understand why transparency is important when organizations collect and exploit personal data, but I wonder whether applying similar obligations to individuals publishing non-commercial creative work is proportionate. Has this tradeoff between data protection, pseudonymous publishing and the independent web been discussed in the context of GDPR? Is there an established interpretation or any relevant exemption for such cases?

Is this exclusive to Essex or is it pretty much the case across all councils?

my data was involved in a data leak (the double counter discord bot??) and i just want to ensure i word it correctly so my data is fully removed and no longer shared :,) are there specific things i must refer to in my request to remove my data?
thank you for any help in advance i feel way out of my depth here haha

To access my Ford credit account I have to receive a verification text message, there’s no other option for verification. I’ve been told that to receive the verification text I have to accept marketing texts. I don’t want marketing texts. Is this a breach of GDPR rules? If so what can I do?

Hi everyone — I’m Thibault, a tech reporter at Business Insider.

I’m looking to speak with employees at European organizations that have moved from, or are considering moving from, a US AI provider like OpenAI or Anthropic, to Mistral.

I’m especially interested in cases where data sovereignty, cybersecurity, procurement rules, customer contracts, or sector-specific requirements shaped that decision.

I’d like to understand:

• Which US provider or model did your employer use or consider,
• Why Mistral was chosen instead,
• Whether EU hosting, private deployment, or Mistral’s open-weight models mattered,
• What trade-offs did the switch create in model quality, cost, or developer experience?

This is for a Business Insider story. I’m happy to start with an off-the-record/background conversation and discuss attribution or anonymity before using anything.

If you are open to talking, please email me at tspirlet@businessinsider.com

Thanks,
Thibault Spirlet

I run a small website in the Netherlands. I want to put a consent banner on only one page, because that's the only page with non-essential tracking. While researching, I noticed that a lot of websites load Google reCAPTCHA on their contact or login forms without asking for consent first.

As far as I can tell, reCAPTCHA sets cookies and collects device and behavioral data, and it sends this to Google. But I've also seen the argument that it's "strictly necessary" for security (spam and bot protection), which would exempt it from consent under ePrivacy.

My questions:

1. Is there a clear legal position on whether reCAPTCHA needs prior consent? Has any regulator (AP, CNIL, others) or court given guidance?
2. If it does need consent, why do so many sites run it without? Is it a lack of enforcement, a different interpretation, or something else?
3. What do you recommend as a compliant alternative (e.g. Cloudflare Turnstile, hCaptcha, or loading reCAPTCHA only after consent)?

If you have an answer, it would be really helpful if you could include a source (a regulator's guidance, a court ruling, or the relevant article of the law). That way I can check it myself, and others reading the thread can too.

Thanks!

England, UK

Hello,

I am looking to access information to further independently investigate a situation at work.

For context, my situation pertains to:
Reasonable adjustments
Management conduct
Performance monitoring
Recruitment processes
Salary review processes
Correspondence between various managers

I am looking for any kind of advice on how to effectively structure a SAR request.

I have a large amount of my own information, but my goal is to fill the gaps in my chronology/understanding of events and identify any other potentially relevant information.

I’d welcome any kind of guidance on how to approach and structure the request. This includes any practical advice on wording, themes, and document types.

My goal at this early stage is the request being sufficiently broad in scope, whilst still being targeted towards the information that is relevant.

Thank you in advance!

I work in a UK contact centre with a fairly toxic, high-pressure environment. I'm currently being investigated for potentially failing to follow GDPR verification procedures on certain customer calls.

I've acknowledged that I may have missed verification checks on some occasions, although I haven't been shown the specific calls. Nothing was intentional and my performance has been okay. My line-manager is satisfied with my goals. The manager investigating this is from a completely different department.

I have diagnosed ADHD + an occupational health report, which my employer is aware of. I sometimes struggle when customers become confrontational or pressure me or are abusive to bypass verification. Our procedures also change frequently, and the e-learning modules are quite basic, with little refresher training.

HR initially questioned me about GDPR procedures, possible breaches, customer pressure and my recent sickness absence. They've now sent another detailed questionnaire specifically about my ADHD, how it affects my ability to follow procedures, what reasonable adjustments I receive and whether further Occupational Health input is needed.

I've cooperated fully, acknowledged potential mistakes and requested GDPR refresher training.

Am I at risk of being dismissed? Does HR asking detailed questions about ADHD and reasonable adjustments suggest they're considering support, or could dismissal still be the outcome? I am genuinely very scared at this point.

I'd really appreciate opinions from anyone familiar with UK employment law, HR or GDPR investigations.

When does it become unreasonable? DSAR submitted two weeks ago, 2 month extension automatically applied by them.

I requested phased disclosure and asked for the grievance and appeal documentation, which they agreed to.

These are documents that were recently created and relied on during the process and are readily available and accessible without requiring a search.

Wondering how hard to push it, I want those documents before requesting to edit my ET1.

I’ve spent the last few years in privacy and compliance: handling data subject requests at a domestic violence nonprofit, working on risk and regulatory matters at a national healthcare nonprofit, and now consulting on AI governance. I have a law degree, an LLM and an MA in Data Protection from DCU in Dublin.

I’ve also built my own DSAR tracker that calculates UK and EU deadlines, chases reminders and produces an evidence log. Now I’m trying to understand whether it solves a real problem for others, or whether I’m focused on the wrong thing.

For those at 30 to 200 person companies:

1. How do you track DSARs and deletion requests today? Spreadsheet, tool, shared inbox?
2. What’s the most annoying part: deadlines, finding the data across systems, ID checks, or proving you responded on time?
3. Is there something in your privacy or compliance work that’s even more painful than DSARs? Vendor reviews, ROPA updates, DPIAs, breach logs, AI tool approvals?

No links, not pitching anything here. I’d just rather learn what actually hurts than build something nobody needs. Happy to share what I’ve learned about DSAR deadlines and the new UK complaints rules in return.

I want to make a video game server and im wondering if when i collect ip adresses linked to the players account to have the capability to ip ban players, is that legitimate interest (meaning that i don't have to make them accept the privacy policy)

Hi everyone!
I’m 17 years old, currently finishing high school in Brazil, and planning to start university in 2027.
My long-term goal is to build a career in Digital Compliance, Data Privacy and Data Protection, particularly working with Brazil’s LGPD (General Data Protection Law), which is similar in several ways to the European GDPR.
I’m considering pursuing a Law degree at Anhembi Morumbi University, which advertises a Digital Law-focused program in partnership with Opice Blum Academy, a Brazilian institution specializing in technology law.
However, I’m still researching whether this would be the best academic path for the career I want.
I’ve been studying English with a private tutor for over five years, have an advanced level of proficiency, and would also like to pursue professional certifications during university.
I would really appreciate some advice from professionals working in privacy, compliance, data protection or related legal fields.
My main questions are:
Is a Law degree a good foundation for a career in Privacy and Data Protection Compliance?
Would you recommend studying Law, or would another degree, such as Information Systems or Cybersecurity, offer better opportunities?
How important is the university’s reputation compared with practical experience and professional certifications?
Which certifications would you recommend for someone starting out? I’ve been researching IAPP certifications such as CIPP/E and CIPM.
What technical skills should a future privacy or compliance professional develop?
If you were starting your career again, what would you do differently?
I’m particularly interested in the intersection of law, technology, corporate compliance and personal data protection.
Any advice, experiences or recommendations would mean a lot to me. Thank you!

I run a small WhatsApp-based app for small family businesses in the Dominican Republic and Brazil in the future. My users are B2C only, and I only target Latin America. I have no EU users and no plans for any. I am based in EU.

Part of the processing runs through an AI model, with personal details redacted first.

Do I really need to follow GDPR strictly, or is the local law (DR Ley 172-13) the one that applies to me?

When my users' customers message them, should the app send an automatic greeting asking for consent, with "STOP" as the opt-out? Or is collecting consent my users' job as the businesses, and I only provide the tool? If it's their job, am I expected to enforce it?

Thanks! Not looking for formal legal advice, just how people in similar setups handle it.

Hi everyone, I’m looking for honest advice from anyone familiar with UK employment law, local council HR procedures or probationary dismissals.
I recently started a job with a local council and am still very early in my probation period (less than a month into the role).
I posted a message in a residents’ WhatsApp group about a property on my estate that has apparently been empty for around five years. The issue had already been discussed among residents, and I understood from estate management that the property was not paying council tax. Based on that information and my own calculations, I estimated that the unpaid council tax could be over £10,000.
I now understand that the council considers this a potential data breach because the message disclosed financial information relating to a resident. I want to be clear that I did not access council databases or internal systems to obtain this information, and I did not disclose the owner’s name or personal details. The figure was my own estimate based on information I had heard and calculated myself.
I attended an investigatory meeting today with the investigating manager and HR support. The allegation was treated seriously, and I was told it could potentially amount to gross misconduct. I explained how I obtained the information, acknowledged the seriousness of the situation and apologised.
The manager said my apology had helped and would be taken into consideration, and that she would speak to HR before making a decision. However, she subsequently mentioned a “probationary hearing” and told me to contact HR. I have not yet received a formal invitation or confirmation of what the next meeting would involve.
The council’s probation policy says formal action can be taken for serious issues during the first few months of employment. It lists possible outcomes including informal action, further monitoring and dismissal. It also says reasonable adjustments and alternatives should be considered before dismissal.
A little more context:
I previously worked for the police, so the manager questioned why I had not recognised the confidentiality implications. I explained that my previous role involved a different working context, where communicating with local residents about community issues was sometimes encouraged.
I have autism, and I am concerned about how my understanding and retention of e-learning and workplace guidance may have affected the situation. I would want any relevant reasonable adjustments to be considered.
I genuinely want to keep my job, and I accept that I should have thought more carefully before posting the message. I did not intend to cause harm or misuse confidential information.
My questions are:
Does being told there may be a probationary hearing suggest that dismissal is being actively considered?
Given that I am so early in probation, is dismissal a realistic or likely outcome, even though I did not access council systems and apologised?
Could further monitoring, training or an extension of probation realistically be considered instead?
Does the fact that the figure was my own estimate, rather than information obtained from a council database, make a meaningful difference?
What should I ask HR before the next meeting, and should I request reasonable adjustments or take someone with me?
I would really appreciate honest opinions, especially from anyone who has dealt with a UK local authority probation process. I’m not looking for reassurance if dismissal is genuinely a serious possibility; I just want to understand where I stand and prepare properly.
Thank you.

I am getting a lot of spam while simultaneously ensuring that I don’t sign up for mailing lists. I try where possible (if it comes from a domain email) to report to ICO on the spamming link, but am I actually wasting my time? Are there other sites to which one can easily report spam email that will actually make a difference (or have an impact on their domain so they are inclined to stop?