So, if a client has settled on a specific retention period, the question isn’t whether the number is right, it’s whether they can show their decision making that arrived at the number. 

A recent conversation I had with a colleague has inspired this week’s blog about a specific use of AI. AI tools that scan, rank, and filter job applications are everywhere now. They save time, and nobody's arguing otherwise.

Do you know which AI tools are being used across your business right now, including the ones nobody formally signed off on? If personal data is flowing into any of them, that's a GDPR question as much as a technology one.

"Legitimate interests" is one of six lawful bases for processing personal data under GDPR, and the most flexible. Used well, it lets businesses process personal data confidently - not just as a fallback.

You're not expected to produce data you no longer hold. But you are expected to tell people, upfront, how long you keep their data.

An independent publisher turned down a data access request, arguing it was too small a company to carry out the review involved and that the request was, in its view, excessive.

A practical, plain-English guide for Irish and UK business owners.

We were recently asked by a new client to evaluate their US-based agentic AI.

The short answer: yes, GDPR applies. But no, that doesn't mean event organisers need a signed form from every person in a room.

The answer lies in how Word documents are converted to PDF without first being cleaned.

Many business owners assume these devices are covered by a personal exemption.

Before employees work from home with access to personal data, carry out a risk assessment.

EU-US data transfers are open — for now. But the history of this area tells us that "for now" can change quickly.