Sensitive Data & Minors
The consent age for minors varies by country
The age at which a child can consent to online services on their own ranges from 13 to 16 across EU member states, since GDPR lets each country set its own threshold.
Sensitive Data & Minors
Schools must genuinely verify parental consent
When a school photography service needs a parent's consent for a young child, GDPR expects a genuine effort to verify that consent actually came from a parent - not just a checkbox.
Data Subject Rights & Consent
A camera at an event still needs a lawful basis
Photographing people at an event still counts as processing personal data under GDPR - organisers need a lawful basis, such as consent or legitimate interest, and a clear way for people to opt out.
Data Protection Officers (DPOs)
The contact details of a DPO are public
Organisations must publish their DPO's contact details and share them with the supervisory authority, so people and regulators always know who to contact.
Data Protection Officers (DPOs)
Three triggers force a mandatory DPO
You must appoint a DPO if you're a public authority, if your core activity involves large-scale systematic monitoring, or if it involves large-scale processing of sensitive data - hitting just one trigger is enough.
Privacy by Design & Data Sharing
A processor needs permission to use another one
A processor cannot bring in a sub-processor to help handle your data without the original company's prior authorisation - general or specific, but always documented.
Privacy by Design & Data Sharing
A data processor needs a written contract
Whenever a company hands personal data to a processor to handle on its behalf, GDPR requires a written contract spelling out exactly what the processor can and cannot do with it.
Data Protection Officers (DPOs)
A DPO answers to the top, not middle managers
A Data Protection Officer must report directly to the highest level of management, not to a department head or line manager, to keep their advice independent.
Fines, Penalties & Data Breaches
A SERIOUS BREACH MEANS TELLING PEOPLE TOO
If a data breach is likely to put people at serious risk - like identity theft or fraud - the company must tell those individuals directly, not just the regulator.
Fines, Penalties & Data Breaches
DATA BREACHES MUST BE REPORTED FAST
Once a company becomes aware of a personal data breach, the clock starts ticking: it must notify the supervisory authority within 72 hours wherever feasible.
GDPR News & Updates
ONE REPORT COULD SOON COVER FIVE EU LAWS
Under the proposed Digital Omnibus, a single incident report could satisfy reporting duties under NIS2, GDPR, DORA, eIDAS and the CER Directive at once, instead of five separate filings.
GDPR News & Updates
The EU Proposed Its Biggest GDPR Overhaul
In November 2025, the European Commission proposed its biggest GDPR overhaul yet - part of a wider Digital Omnibus package simplifying GDPR, the AI Act, the Data Act, and EU cybersecurity rules together.