GDPR, PCI & Data Privacy Insights
Practical compliance guidance for IT administrators and security engineers. No filler, no legal boilerplate - just actionable advice for lean teams.
When you need a DPIA, and how to tell before you need one
Article 35 requires an assessment where processing is likely to result in a high risk. Here's what triggers it, and why the screening question is the one worth building into your process.
Confirming your PCI scope every twelve months
PCI DSS 4.x asks you to confirm the scope of your cardholder data environment at least once a year. Last year's diagram with a new date on it does not meet it.
General-purpose AI: the Chapter V obligations
Chapter V sets duties for providers of general-purpose AI models, and a second, heavier set for models classed as carrying systemic risk. Here is what each covers, and which parts reach you if you only use these models.
ROPA, data map, asset inventory: three things that get conflated
They overlap enough to be confused and differ enough that substituting one for another leaves a gap. Here's what each answers and how they connect.
How to run a legitimate interests assessment
Legitimate interests is the most flexible lawful basis and the only one that asks you to weigh your interests against the individual's. Here's the three-part test as something you can actually complete.
Masking, truncation and hashing: what you can show, and where
Three treatments for a card number that are routinely used as synonyms. The PCI SSC defines them separately, and the difference decides whether a control does what you think.
Article 26: what a deployer of a high-risk system has to do
Most organisations deploy AI systems rather than build them. Article 26 sets out what that role carries: instructions for use, human oversight, input data, monitoring, logs and notification.
Controller or processor? The test, and why the answer changes your duties
The distinction turns on who decides the purposes and means of processing. Getting it wrong means the wrong contract, the wrong record, and obligations sitting with the wrong party.
A ROPA field by field, using the ICO template
Article 30(1) lists what a controller's record has to contain. Here's each field, what belongs in it, and the way each one usually gets filled in wrongly.
AI Act and GDPR: where a FRIA and a DPIA overlap, and where they don't
Article 27 fundamental rights impact assessments and Article 35 data protection impact assessments ask different questions about the same deployment. What you can genuinely reuse, and what you can't.
EmberHound vs Spirion: where each one fits
Both find sensitive data. They are built for different buyers, and the honest comparison is about who is going to operate the tool rather than which one is better.
What counts as cardholder data, and what you must never store
PCI DSS draws a hard line between cardholder data and sensitive authentication data. One you may store under conditions. The other you must not keep after authorisation, at all.
Cardholder data outside the CDE: the question SAQs don't ask
A self-assessment questionnaire scopes your payment environment. It doesn't ask whether primary account numbers have leaked into spreadsheets, support notes and email on staff laptops.
Article 4 AI literacy: what it asks for after the Omnibus reworded it
The AI literacy duty has applied since 2 February 2025, covers every organisation using AI regardless of risk tier, and was reworded rather than deferred. What changed, and what to document.
Article 32: what "appropriate technical measures" actually means
Article 32 names four measures and then hands the decision back to you via risk. Here's how to read it, and what the ICO looks for when it asks what you did.
The Article 30(5) exemption, and why it rarely gets you out of a ROPA
Article 30(5) looks like it excuses organisations under 250 staff from keeping a record of processing. Read the conditions attached and almost nobody qualifies.
The right to erasure: what counts as proof you deleted it
Article 17 reaches every copy you control, including backups and endpoints. A confirmation email is not evidence. What an audit-ready erasure record actually contains.
How to build an AI system inventory, and why your ROPA isn't one
AI Act duties attach per system. Before you can classify anything, assign oversight, or retain logs, you need a list of what you are actually running. What to record, and where the unlogged systems hide.
Annex III: the high-risk categories, listed plainly
Annex III lists the areas where an AI system may be classified high-risk under Article 6(2). Here is what each of the eight covers, described rather than interpreted.
Which PCI SAQ applies to you, and why the wrong one gets picked
The self-assessment questionnaire you complete is determined by how you take payments, not by how big you are. Picking the wrong one produces an attestation that does not cover what you actually do.
What happens to personal data when an employee leaves
Offboarding checklists cover accounts, licences and hardware. They rarely cover the customer data in the leaver's local files, mailbox exports and downloads, which is still there when the machine is reissued.
Deployer or provider? How to work out your role under the EU AI Act
Most organisations using AI are deployers. Putting your name on a system, modifying it substantially, or changing what it is for can make you a provider, and the obligations are an order of magnitude heavier.
The six lawful bases, and how to choose one you can defend
Article 6 gives you six lawful bases and no ranking between them. Here's what separates them in practice, why the choice is harder to change than to make, and what you need to hold to justify it.
How long can you keep personal data? Building a retention schedule you can enforce
GDPR's storage limitation principle sets no fixed periods. Here's how to set ones you can justify, and how to check they held on endpoints as well as in the systems that have a delete button.
AI Act Article 50: what you must tell people about chatbots and AI-generated content
Article 50 applied on 2 August 2026 and attaches to how a system interacts with people, not to its risk tier. Two duties sit with providers, two with deployers. Here's which is which, and a checklist you can run this week.
The EU AI Act's high-risk deadline moved. Here's what still applied on 2 August 2026.
The Digital Omnibus deferred the Annex III high-risk obligations to December 2027. Article 50 transparency was not deferred. A plain reading of what is live now, what moved, and the dates that are closer than they look.
Best GDPR & sensitive data discovery tools for lean teams (2026)
Eight GDPR and sensitive-data discovery tools compared on deployment time, real pricing, and who each one actually fits - reviewed honestly, disclosure included.
What is a DSAR and how do you respond within GDPR's deadline?
A Data Subject Access Request (DSAR) gives individuals the right to see every piece of personal data you hold about them. Here's the practical IT admin's guide to responding on time.
GDPR Article 30: how to build a Record of Processing Activities without a spreadsheet
Article 30 requires every organisation with 250+ employees to maintain a formal ROPA - but even smaller teams should have one. Here's how to build an audit-ready record without drowning in spreadsheets.
PCI DSS 4.0 scope reduction: why endpoint scanning beats annual questionnaires
Reducing your PCI DSS cardholder data environment scope is the most effective way to cut compliance cost. Here's how endpoint scanning changes the game versus traditional SAQ approaches.
How to prepare for a GDPR audit: the IT admin's 11-point checklist
A practical 11-point checklist for IT administrators preparing for a GDPR audit or ICO investigation. Covers documentation, access controls, breach readiness, and data discovery.
Data breach notification under GDPR: what you must do in the first 72 hours
GDPR Article 33 gives you 72 hours to notify your supervisory authority after discovering a personal data breach. Here's a practical timeline and decision framework for IT teams.
Want more of this in Google?
See what personal data your endpoints are hiding
EmberHound scans your devices for GDPR and PCI data - no manual spreadsheet required.