Guides to the written evidence the GDPR expects: the record of processing, privacy notices, retention schedules, legitimate interest assessments, policies, DPIAs and data protection by design in product work.
A step-by-step approach to the Article 30 record: inventorying activities, the fields controllers and processors must fill in, who owns it, the 250-employee exemption and the proposed 750 threshold, and keeping breach records alongside it.
What a GDPR privacy notice must contain under Articles 13 and 14, deadlines when data come from third parties, the layered approach the EDPB recommends, notifying changes before they take effect, and the 2026 enforcement focus on transparency.
How to set and enforce retention periods under the storage limitation principle: where retention must be documented and disclosed, legal retention duties versus erasure, the default to keep data no longer than needed, and why backups and deletion keep failing in audits.
How to document a legitimate interest assessment: the EDPB's three cumulative conditions, reasonable expectations, the recital examples for fraud prevention and network security, when public authorities cannot use it, and what changes for the data subject's rights.
The written policies and procedures behind GDPR compliance: what Article 24(2) asks for, the documents the regulation names, internal security and awareness policies the EDPB recommends for small businesses, and how codes of conduct and certification can support them.
Running a data protection impact assessment end to end: deciding it is needed, the minimum content, DPO advice, the EDPB template, testing and re-assessing it, when residual high risk forces prior consultation, and how long the authority has to answer.
How engineering and product teams apply Article 25: designing minimisation and pseudonymisation in, privacy-protective defaults, worked EDPB examples, legacy systems, processors' role, and using certification to evidence design choices.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.