Guides to how GDPR requirements differ by sector: healthcare, HR and employee data, AI systems, children and education, the public sector and e-commerce.
GDPR rules for health data: the Article 9 prohibition and care exception, professional secrecy, national add-ons, when DPIAs and DPOs become mandatory, access by default, and a 2026 hospital fine for weak remote access.
How the GDPR applies to employee data: why consent rarely works, legal obligation and employment-law bases, national employment rules under Article 88, special category data, and automated decisions about workers.
GDPR questions for AI products: when a model is anonymous, legitimate interest for training and deployment, reasonable expectations, models built on unlawful data, automated decisions, DPIAs, and the link to AI Act deployer duties.
Rules for services used by children: the age of digital consent and national variations, verifying parental consent, child-adapted information, the erasure ground for data collected from children, and DPIA triggers for vulnerable people.
How the GDPR treats public authorities differently: a mandatory DPO that can be shared, no legitimate interest for public tasks, limits on portability and transfer derogations, and national choices on fining public bodies.
GDPR for online shops: collecting only what each order needs, contract necessity versus marketing, recommendations and direct marketing objections, cookies under the ePrivacy rules, and customer rights requests.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.