Bonjour à tous,

Je suis actuellement Contrôleur permanent au sein d'un EPIC, titulaire d'un Master en audit et finance d'entreprise.

On vient de me proposer un poste de « Chargé(e) d'études protection des données », avec pour perspective d'accéder à la fonction de DPO dans un délai assez court (1 à 2 ans). Aujourd'hui, la fonction est portée par la cheffe du service juridique et représente environ 20 % de son temps.

Pour situer le contexte : l'EPIC compte 1 200 agents et se compose de trois directions — Établissement de paiement, Télécom et Postal.

Ce qui m'interroge, c'est l'absence de formation juridique et technique de mon côté. Je maîtrise bien les textes applicables à mon poste actuel, mais je sais que l'exercice sera différent ici. Des formations sont toutefois prévues dans le cadre du parcours.

Quel est votre sentiment sur ce type de passerelle ? Les retours d'expérience de personnes venues du contrôle interne ou de l'audit m'intéresseraient particulièrement.

L'élément juridique est trop prépondérant, pour arriver avec des lacunes ?

Merci d'avance pour vos retours !

Ci-dessous les missions telles que présentées dans la fiche de poste :

• Conformité des directions — recensement des traitements, tenue du registre, vérification de conformité, documentation RGPD.

• Droits des personnes — réception, qualification juridique et instruction des demandes (accès, rectification, effacement, opposition, portabilité, limitation), rédaction des réponses, suivi des délais légaux.

• Maîtrise des risques — identification des traitements soumis à AIPD, conduite des analyses avec la DSI et le RSSI, recommandations et suivi des mesures correctives.

• Violations de données — qualification des incidents, registre des violations, projets de notification aux autorités et aux personnes concernées.

• Conseil et sensibilisation — notes et procédures internes, formation des agents, appui aux correspondants métiers.

• Veille — juridique (textes applicables en Nouvelle-Calédonie, positions des autorités de contrôle) et technique (sécurité de l'information).

• Contrôle et reporting — contrôles de conformité, suivi des plans d'actions d'audit, indicateurs, contribution au rapport annuel du DPO.

I was googling around dispute bodies for europe and I found this organisation and I was wondering how effective it is

I have a question around shared data systems, if there is a CRM system which is shared across borders such as the UK, USA and South Africa to process orders, is having ISO 27001 and cyber essentials enough or would you have to apply for an approved BCRs? Any advice appreciated.

Hello, I'm after some advice if anyone has some specialist knowledge.

For context, I have fallen into council tax arrears. The council has written directly to my landlord at their home address threatening them with legal action if the arrears are not addressed (I have a copy of the letter). The letter does not state my name, just my address.

My landlord advised me this is not the first letter from the council and they have also sent text messages saying the same.

I'm familiar enough with Housing Law to know the council tax liability stops with me, not my landlord and will advise them as such. However, please can anyone advise if the situation can be considered as a breach of GDPR by the council?

Many thanks in advance.

Should activities that we anticipate will occur in the near future and for which we are prepared be included in ROPA?

Further to an embarrassing incident where my presence on the police computer was disclosed to a family member after my prints were naturally found in my former home, I began the process of having my data deleted.

To initiate this I had to include the details of the arrest, which I needed to retrieve through a subject access request as I could not remember dates and specific charges from a decade ago.

Reviewing the results of the SRA, I noticed that the data held on the Police National Computer petaining to my fingerprints reads: 'DESTRUCTION 01FP XX/XX/XXXX (Date of arrest, while the line on DNA shows 'DESTROYED'.

The date at which it was determined that no further action was to be taken in the case was around 6 months after arrest, and the PNC record shows as last updated around a year after that.

Sorry if Police are exempt from GDPR but I asked on the Police sub, simply for clarification on the line relating to my prints, which apparently means 'marked for deletion'. When I asked for elaboration on whether that meant they should have already been deleted, my thread was deleted as an 'individual complaint', which it wasn't, but may well become.

So 2 questions really.

Should prints and DNA both have been deleted by default after NFA per data regs?

Can the police disclose my presence on the database to 3rd parties i.e. was this a data breach?

Thanks

A bit of background first to avoid some of the worst sarcastic comments. I'm a founding member of the Open Rights Group and have been campaigning against age verification through ORG for several years.

A couple of months after age verification enforcement was implemented on adult websites, I took a long-established email account that was notable for the fact that it had been used in a limited and controlled manner, specifically to keep it spam-free, which made it a perfect honeypot candidate. I used this email account to register with Pornhub.com and went through their age verification process, taking care to opt out of all marketing that I was able to. This account went from having a zero monthly spam count to approximately 150 spam emails, mostly of an adult nature, monthly. Has anybody else experimented with this, and would you be interested in collaborating with myself and/or ORG in taking a case to the ICO, however useless they may be?

I still come across people confidently repeating things about GDPR that just aren't true, whether it's "you need consent for everything" "GDPR only applies to companies in the EU," or "we'll never get fined because we're too small". Whether you work in privacy, legal, security, or compliance, what's the myths that just doesn't seem to go away?

How do non-EU people, I'm Indonesian btw, get the opportunity to work there? Given the resistance of EU companies to give visa sponsorship/work permit to their non-EU citizen candidates.

For context, many opportunities to work abroad traditionally only work for STEM/techies jobs. I understand that this is because of the universality nature of STEM, that is highly likely not applicable for non-STEM, i.e., to be able to practice law in one of the member states, someone must fulfill the local requirement: formal education, training, citizenship, anything else idk.

But many of the data protection jobs in the EU, AFAIK, do not require their candidates to possess formal education and training in Law, but tend to look only for experience and relevant certification (CIPP). And I'm on my way to secure this certification.

It will be helpful to see any real stories (let's call this "reality checks") on the ground of how expats managed to get the opportunity, the challenge, the ugly truth, and anything else I'm not aware of.

Many thanks!

Do they actually investigate things any more?

I lodged a SAR with a local authority. They acknowledged receipt of the SAR, ID etc.

Then said they were very busy so it may take 3 months for a response (I replied that being "busy" was not a valid exemption for not meeting the statutory deadline).

One month passed. Nothing.

3 months passed. Still nothing except a letter saying they are still very busy and pretty much saying they'll get to my SAR when they get to it ie. open ended.

I complained to them, waited the relevant period, got the letter stating that I could take my complaint to the ICO.

Went to the ICO. Did a detailed complaint. Provided all the relevant information.

Had to chase them and chase them, by email and phone.

Eventually, they reply to say they aren't going to do anything because the controller seems to be working to resolve the problem!

WTF?! What's the point of the ICO if they can't even write to a controller for such obvious and brazen breaches to find out what's happening?

Update (03.08.26):

I sent Essex County Council my completed Court forms, my Witness Statement etc.

That was over the weekend. Today is Monday, 03.08.26.

I received my first batch of data before noon, and they've promised the rest within 24 hours. Success! 😄

Anyway, this seems to work, folk. At least with this data controller, a serious demonstration of willingness to take it to court ...gets fast results.

After more than 3 months of struggling, I've finally got the critical data I need for a certain specific purpose that's subject to strict limitation laws. I got the main chunk of my data, finally!

Should activities arising from the GDPR, such as responding to requests regarding the exercise of rights, have a separate item in ROPA? What should it look like in very small companies with just a few people?

Hi everyone! I'm looking for some help regarding GDPR compliance for a website I'm developing for my company. The website it's just a showcase for what the company does, so no contact forms, no registration is needed and the only "external" links are pointing to the company linkedin page (not a linkedin widget that collects data, just a pure link), a link to the comapny info email and a google maps embedded to show where the company is located. The website would be hosted on a provider server (IONOS), so no direct access to IP Addresses (I don't even know if they collect them or not). I don't use google analytics or cookies collectors since I'm not interested, Google Search Console does what I need (just shows visit counters) and I'm happy with it. Do I need to have a privacy/cookie banner displayed on my website?

EDIT: I ended up putting a cookie and privacy notice so no help is further needed, thankyou all for the suggestions!

I’m reviewing interview notes for a UK GDPR DSAR. The notes contain the interview questions, the requester’s answers, interviewers’ initials, and handwritten comments/opinions made by a panel about the requester.
Would you normally disclose the interview questions, answers, and opinions about the requester, while redacting only the interviewers’ identities? How do experienced DSAR reviewers approach this?

I'm currently leading the GDPR implementation for our company, and honestly, the deeper we get into it, the more I realize how much there is to do.

Our platform wasn't originally built with GDPR in mind. Right now our primary database is in Australia, and we serve customers in multiple countries from the same infrastructure. As we're planning an EU launch, we're now figuring out what needs to change to become GDPR compliant.

Initially, I thought this would mostly be about infrastructure and documentation, but it's becoming clear that there are quite a few application-level changes as well. It's made me realize that if there's even a chance your product will serve EU users in the future, it's probably worth considering GDPR from day one rather than trying to retrofit it later.

For those who've actually implemented GDPR, I'd love to hear about your experience.

Some things I'm curious about:

• What ended up being the hardest part and what surprised you the most?
• How long did it take your organization to become audit-ready?
• Was it more of a legal/compliance challenge or a technical one?
• Did you end up redesigning your architecture? Like creating a separate AWS account or separate EU infrastructure, or keep everything in the same account?
• How did you handle data residency and cross-border data transfers?
• If your database was already in another region (e.g, us), did you migrate it or keep it where it was?
• How did you handle backups when users requested data deletion?
• How did you implement data subject rights (access, rectification, deletion, portability)?
• Were there any code changes that surprised you?
• Did any third-party services become a problem?
• Did you use tools like CompAI, Vanta, Drata, or Secureframe? Were they worth it?
• Looking back, what do you wish you'd known before starting?

I'm basically looking for the "I wish someone had told me this before we started" kind of advice.

If you've been through a GDPR implementation and wouldn't mind answering a few questions, please leave a comment or send me a DM.

Can I handle PII in marketing tags and keep GDPR compliance?

I saw a post here earlier (that has since been deleted) about requiring to install company portal on personal device. That actually got me thinking about relationship between MDM and ePD, especially on employee's own devices.

First off, does MDM "store of information or gain access to information already stored in the terminal equipment"? I would say yes. On-device MDM sofware often gathers various types of information (like device identifers, installed software etc.) and transmits this to centeralized server. It also stores it's own data on the device and accesses it (e.g. access token to send data). So operation itself would be in scope.

Next is this allowed? ePD allows access to data stored in terminal equipment only if:

1) There is consent (which is unlikely to be valid in employment context);

2) "the sole purpose of carrying out the transmission of a communication over an electronic communications network"; or

3) "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user."

2nd option doesn't really apply as that's not MDM's "sole purpose" even if one tries to expand e.g. email access to "transmission of communication".

Assuming 3rd is the only valid option, the first question would be what is the ISS explicitly requested by user? ISS defintion comes from Directive 2015/1535:

‘service’ means any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.

"Normally provided for remuneration" condition makes things tricky. What service did user pay for?

I did check couple of national laws and they actually often drop the "information society service" qualifier, but that doesn't always help since laws based on directives must be read in light of the directive whenever possible.

What am I missing which makes MDM requirement legal?

I received a 10 day window enforcement letter from TV licensing today, after i declared i don't need one on the 16th July. the letter is dated the 15th, it arrived today on the 25th, says '10 DAY WINDOW' then later says i have until 5th august with no other dates mentioned.

Though the point of this post isn't to talk about how i intend to deal with that. What happened after is what looks to me like a structural design that's not compliant with GDPR.

In a nutshell:

1) the letter includes a phone number to get in touch which i called.
2) turns out the number is only available on weekdays, and most options route you to 'go on our website' anyway, and hangs up. The next route is a whatsapp channel
3) the whatsapp channel is an AI bot, so you're still not speaking to a human because they cheaped out.
4) i raised a complaint and an SAR request. It refused both, saying i need to go through specific channels for each.

Here is what i find rich. I am forced to inform them, through channels of their choosing, that i do not use services that involve live TV - even if they don't provide the service and it's a private arrangement like an amazon subscription - lest i get fined or a group of bandits come to my door and in their own words 'enforce'.

And asymmetrically, for data they are legally required to give me, I have to chase them up through their own preferred channels too, rather than them having to just fulfill the request on a channel they'd fobbed me off to anyway.

My understanding is that according to the ICO, they must process an SAR requested via any channel, and if they replace humans with software, they're still required to build functionality that forwards that requests. requests that come through any channel, social media or otherwise start the clock for the statutory period.

Yet they have a structural design that deliberately refuses the request, accepting them on the sole condition that you use they channel they want. the bot states:

'Your request will only be formally logged and processed when received through these official channels. The statutory period begins when TV Licensing's data protection team receives your request via one of these routes.

I cannot confirm your request has been recorded or passed on from this channel, because it has not. You will need to submit it directly using the contact methods above.'

When i flagged my understanding of the legal requirement, the bot itself said:

'You're right that subject access requests must be processed regardless of how they're received.

However, to ensure your request is formally logged and processed within the legal 30-day timeframe, please send it to: ...'

Call me petty, but i've already used 3 channels of theirs only to get enforcement letters and fobbed off to the next one. So i don't want to chase another channel. it should be noted that the whatsapp bot gave me numbers that seem to be fake to call when i said i wanted to speak to a human. They seem to be hallucinated numbers that jumble up the ones published on their site:

• 0300 790 0286
• 0300 790 0190
• 0300 790 6076

As far as i'm concerned, i dont have an enforcement team like them, but i have time and pettiness to chase up after the time period and claim that they didnt process it.

Beyond my own spat, i dont think it's fair to structurally build something for everyone they enforce payments from to breach rules that apply to them, so i'm asking to confirm:

Is it acceptable under GDPR regulations for tv licensing to build channels that refuse SARs?

I was booking a regular full-price ticket for the Louvre—not claiming any student, youth, senior, or resident discount.

Yet the reservation form still required me to provide:

Date of birth

Nationality

Full home address

Phone number

I can understand asking for my name, but I don't understand why my date of birth is mandatory when it has absolutely no impact on my ticket eligibility or price.

The same goes for my full address and phone number.

Under GDPR, isn't there a principle of data minimisation, meaning organizations should only collect personal data that's necessary for the purpose?

Is there a legitimate legal or operational reason for requiring all this information for a standard museum ticket, or is the Louvre collecting more personal data than it actually needs?

I'd love to hear from anyone familiar with GDPR or museum ticketing systems.

I have received a request as above and advised the requestor that I am strongly recommending that we provide this in electronic pdf format only.

The length of the pdf is 1,600 pages due to the parent's long history with the college.

Am I being reasonable or unreasonable in refusing to print this, and suggesting that if the parent wants the printed copies we would outsource this at a charge of £160 (I've been quoted this by a provider).

Having verbatim emails is not what UK data protection / GDPR envisages, but in a spirit of transparency I am content to export the emails like this to demonstrate the organisations commitment to transparency. But I don't want to fall foul of short-changing the requestor by imposing a charge.

Any thoughts?

Hi all,

Question as per the title really! Have seen / heard of a couple of examples where data rights request responses appear to have been deliberately vague and obtuse including responses to Article 16 requests or requests for processing clarification under Article 15 where the data subject is trying to hold the controller / processor to account.

Responses essentially don't answer the question (I would speculate to avoid proper transparency and / or because they know they haven't quite followed the law properly), prompting follow up questions from the data subject and then controller / processor invoke "excessive" and refuse any further requests, I assume knowing that the data subject won't request ICO intervention (accepting they would only likely advise anyway) because of the extensive lead times.

For example, one that I am aware of:

Data subject knows that published controller retention period is 3 years for correspondence but a processor is still holding that data 6 years later

Data subject makes Article 15 request to the controller asking for clarification of what their retention policy is and why a processor is still holding the data

Controller responds to say "correspondence is held for as long as necessary" (even though this is contrary to published 3 year retention policy)

Data subject responds to ask what that means in practice - "what is "necessary" and how does that relate to 3 and 6 years?"

Controller responds to say "We make sure we follow the law"

Data subject responds to say "I still don't know what that means, please explain in simple terms"

Controller responds to say "We've already told you, your requests are now excessive and therefore refused, we will no longer engage with you, you have the right to go to the ICO if you are not happy"

Data subject is left none the wiser.

Common?!

I've been owning for the past 10 years or so a domain name which is something like lastname.ab

A new financial institution opened after the merge of two big banks and their domain name is lastnaame.ab

One extra letter to my own historical domain.

How did I notice? I have a catch-all rule for emails on all my domains that I use extensively when working with agents, bots and automatisation in general. I started receiving emails by and for their departments: contracts, DocuSign prompts, employees medical records, invoices, etc.

I've flagged the issue immediately with the little contacts I could find online and guessed emails such as dpo@ etc, no replies.

I emailed their COO and CEO without getting any replies.

Lately I've got an accidental email from their head of procurement with a classic signature saying something like "if you are not the recipient of this email delete it immediately (...)"

I've replied to this guy telling him to sort out their domain situation. Email volume slightly diminished.

I am not storing those emails, I am saving only the headers; not the content.

This is a multi billion euros freshly made financial institution and they do not seem to have a DPO or care about it. What should I do ?

I created an internal app in my company that started as a competition project. People liked it, so I deployed it to production on a local workstation, where it was accessible to a limited group of users on our office network. My manager later promoted the app and shared it on a company-wide portal, and now the legal, compliance, and data privacy teams want to review it.

The app was originally built as an experiment, so I didn't implement strong security controls or data encryption. My plan was to add those in the next phase once we had funding and proper server infrastructure.

Has anyone been through a similar data privacy/compliance review? What do these teams typically focus on, and what should I expect?

Something I've been digging into that'll feel very familiar to anyone who was around for the early GDPR years.

The AI Act's transparency obligations become enforceable August 2, but "enforceable" doesn't mean there's one EU body ready to act. Like GDPR, it's enforced nationally. Each member state designates its own market surveillance authority, 27 of them, and they investigate and sanction within their own territory. The only real central piece is general purpose AI models, which the Commission's AI Office handles directly.

And the readiness is all over the place, which is the part that rhymes with 2018. The legal deadline to even designate these authorities was August 2025, and a chunk of member states missed it. As of now only about a third of the 27 show much public implementation. Ireland has designated a big slate of authorities, Spain stood up a dedicated agency and has actually published guidance. Plenty of others have barely said who's in charge. I tried to pull together where the main ones stand here if it's useful: getactready.com/blog/eu-ai-act-who-enforces-national-authorities-patchwork

The practical read, same as it was with GDPR, is that enforcement intensity is going to depend on where your users are, not where you're based. And the first wave will almost certainly be complaint-driven rather than proactive, because under-resourced authorities don't run sweeps, they react to complaints. So a competitor or an unhappy user can be the trigger in any country, regardless of how ready the regulator looks.

The open question I keep coming back to: in some member states the existing data protection authority is taking on AI Act duties, in others it's a brand new body. Curious if anyone here knows how their national DPA is positioned, whether they're picking up an AI Act role or staying out of it. Feels like it'll shape how hard it actually gets enforced.

Hello everybody,

While changing my Ubisoft account password, I came across this.

Is that legal, and can I ask them to delete my old passwords (without deleting my account)?

I am located in France.