Privacy Moves Daily

2026-08-23

GDPR erasure requests: delete across purposes, retain only what the law requires

A practical GDPR guide to deciding what to erase, what to retain under a narrow exception, how to propagate the decision across systems and recipients, and what evidence makes the response defensible.

Privacy Moves Daily

Legitimate interests under GDPR: prove the balance before you process

Automated decisions under GDPR: when a human review changes the result

GDPR erasure requests: delete across purposes, retain only what the law requires

Personal data breach response under GDPR: the 72-hour decision screen

Data subject access requests under GDPR: search before you export

Records of processing activities: turn the inventory into a working control

International data transfers under GDPR: why signing the SCCs is not the approval

Data protection by design and by default: test the starting state

Valid consent under GDPR: prove the choice, not just the click

Right to object under GDPR: stop marketing immediately, test other uses case by case

Special category data: the two-part GDPR test

Pseudonymisation vs anonymisation: decide whether the identity link survives