AI tools and personal data
Employees paste applicants’ CVs, customer e-mails and the content of contracts into language models — in most companies without a rule, without a contract with the provider and without management knowing about it.
Knowledge
Knowledge
Articles about what is changing in the rules and what it means in practice. We write only about what we know from our own work.
The AI Act: what applies today and what was postponed
If you marked the August date as the day the AI Act would land on you, you were half right.
Why an IT service provider is a processor
An external technician connects to your server, opens the database and fixes a bug.
Cyber Resilience Act: the reporting obligation for manufacturers already applies
Since 11 September 2026, manufacturers of products with digital elements have to report actively exploited vulnerabilities and severe incidents.
How to correctly mark a monitored area
EDPB Guidelines 3/2019 say what has to be on the sign at the entrance to a monitored area and what it is enough to make available elsewhere.
How to write a data retention policy
The GDPR does not ask for a document with that name.
Processing personal data on the basis of consent
When consent is valid, what it must contain and how it is demonstrated.
Tell us what you are dealing with.
Thirty minutes with a consultant who knows your industry. The output is a one-page summary with a recommended approach and an indicative scope — we send it to you even if we do not reach an agreement.