GDPR, PCI & Data Privacy Insights
Practical compliance guidance for IT administrators and security engineers. No filler, no legal boilerplate - just actionable advice for lean teams.
International transfers: adequacy, safeguards and the transfer risk assessment
Chapter V governs personal data leaving the UK or the EEA. Most transfers happen without anyone sending a file, which is why the first job is noticing them.
EmberHound vs OneTrust: where each one fits
OneTrust is a governance platform spanning privacy, consent, third-party risk and AI. The comparison is about whether you are buying a programme or answering a question.
P2PE and tokenisation: how each one changes your scope
Two different mechanisms with two different effects on what you have to assess. Both reduce scope going forward, and neither does anything about the data you already hold.
AI regulatory sandboxes: what Articles 57 to 63 set up
Every Member State has to run one by August 2027. Here is what a sandbox is, what participating gets you, and the one protection that makes it worth considering.
EmberHound vs BigID: where each one fits
BigID covers data security posture, privacy automation and AI governance across hundreds of sources. The comparison is about how much platform your problem actually needs.
General-purpose AI: the Chapter V obligations
Chapter V sets duties for providers of general-purpose AI models, and a second, heavier set for models classed as carrying systemic risk. Here is what each covers, and which parts reach you if you only use these models.
A ROPA field by field, using the ICO template
Article 30(1) lists what a controller's record has to contain. Here's each field, what belongs in it, and the way each one usually gets filled in wrongly.
AI Act and GDPR: where a FRIA and a DPIA overlap, and where they don't
Article 27 fundamental rights impact assessments and Article 35 data protection impact assessments ask different questions about the same deployment. What you can genuinely reuse, and what you can't.
EmberHound vs Spirion: where each one fits
Both find sensitive data. They are built for different buyers, and the honest comparison is about who is going to operate the tool rather than which one is better.
What counts as cardholder data, and what you must never store
PCI DSS draws a hard line between cardholder data and sensitive authentication data. One you may store under conditions. The other you must not keep after authorisation, at all.
Cardholder data outside the CDE: the question SAQs don't ask
A self-assessment questionnaire scopes your payment environment. It doesn't ask whether primary account numbers have leaked into spreadsheets, support notes and email on staff laptops.
Article 4 AI literacy: what it asks for after the Omnibus reworded it
The AI literacy duty has applied since 2 February 2025, covers every organisation using AI regardless of risk tier, and was reworded rather than deferred. What changed, and what to document.
Article 32: what "appropriate technical measures" actually means
Article 32 names four measures and then hands the decision back to you via risk. Here's how to read it, and what the ICO looks for when it asks what you did.
The Article 30(5) exemption, and why it rarely gets you out of a ROPA
Article 30(5) looks like it excuses organisations under 250 staff from keeping a record of processing. Read the conditions attached and almost nobody qualifies.
The right to erasure: what counts as proof you deleted it
Article 17 reaches every copy you control, including backups and endpoints. A confirmation email is not evidence. What an audit-ready erasure record actually contains.
How to build an AI system inventory, and why your ROPA isn't one
AI Act duties attach per system. Before you can classify anything, assign oversight, or retain logs, you need a list of what you are actually running. What to record, and where the unlogged systems hide.
Annex III: the high-risk categories, listed plainly
Annex III lists the areas where an AI system may be classified high-risk under Article 6(2). Here is what each of the eight covers, described rather than interpreted.
Which PCI SAQ applies to you, and why the wrong one gets picked
The self-assessment questionnaire you complete is determined by how you take payments, not by how big you are. Picking the wrong one produces an attestation that does not cover what you actually do.
What happens to personal data when an employee leaves
Offboarding checklists cover accounts, licences and hardware. They rarely cover the customer data in the leaver's local files, mailbox exports and downloads, which is still there when the machine is reissued.
Deployer or provider? How to work out your role under the EU AI Act
Most organisations using AI are deployers. Putting your name on a system, modifying it substantially, or changing what it is for can make you a provider, and the obligations are an order of magnitude heavier.
The six lawful bases, and how to choose one you can defend
Article 6 gives you six lawful bases and no ranking between them. Here's what separates them in practice, why the choice is harder to change than to make, and what you need to hold to justify it.
How long can you keep personal data? Building a retention schedule you can enforce
GDPR's storage limitation principle sets no fixed periods. Here's how to set ones you can justify, and how to check they held on endpoints as well as in the systems that have a delete button.
AI Act Article 50: what you must tell people about chatbots and AI-generated content
Article 50 applied on 2 August 2026 and attaches to how a system interacts with people, not to its risk tier. Two duties sit with providers, two with deployers. Here's which is which, and a checklist you can run this week.
The EU AI Act's high-risk deadline moved. Here's what still applied on 2 August 2026.
The Digital Omnibus deferred the Annex III high-risk obligations to December 2027. Article 50 transparency was not deferred. A plain reading of what is live now, what moved, and the dates that are closer than they look.
Best GDPR & sensitive data discovery tools for lean teams (2026)
Eight GDPR and sensitive-data discovery tools compared on deployment time, real pricing, and who each one actually fits - reviewed honestly, disclosure included.
What is a DSAR and how do you respond within GDPR's deadline?
A Data Subject Access Request (DSAR) gives individuals the right to see every piece of personal data you hold about them. Here's the practical IT admin's guide to responding on time.
GDPR Article 30: how to build a Record of Processing Activities without a spreadsheet
Article 30 requires every organisation with 250+ employees to maintain a formal ROPA - but even smaller teams should have one. Here's how to build an audit-ready record without drowning in spreadsheets.
PCI DSS 4.0 scope reduction: why endpoint scanning beats annual questionnaires
Reducing your PCI DSS cardholder data environment scope is the most effective way to cut compliance cost. Here's how endpoint scanning changes the game versus traditional SAQ approaches.
How to prepare for a GDPR audit: the IT admin's 11-point checklist
A practical 11-point checklist for IT administrators preparing for a GDPR audit or ICO investigation. Covers documentation, access controls, breach readiness, and data discovery.
Data breach notification under GDPR: what you must do in the first 72 hours
GDPR Article 33 gives you 72 hours to notify your supervisory authority after discovering a personal data breach. Here's a practical timeline and decision framework for IT teams.
Want more of this in Google?
See what personal data your endpoints are hiding
EmberHound scans your devices for GDPR and PCI data - no manual spreadsheet required.