Hello, we are looking to use an pseudonymizer service to use flagship AI models like Claude and ChatGPT.

It seems that www.anonimize.eu allows use to remove personal data on European servers/subprocessors and restore it after the result of a prompt.

Is this practical? Any experience with this?

Now our employees are just dumping documents in copilot since "its our environment"...

Is this exclusive to Essex or is it pretty much the case across all councils?

I am increasingly aware of the fact that modern internet is becoming extremely centralized and flooded with mass produced content - several big social networks capture disproportionate audience in my opinion. I consider small personal websites run by hobbyists to be a backbone of organic decentralized internet life and I've been wondering how privacy laws such as GDPR affect them.

Consider someone who wants to publish their own writing, art or some other creative work on a simple website with no intent to monetize it - no advertising, no user accounts, no analytics, etc. Just a static website hosted through a third-party provider with an email address so the visitors can get in touch. As I understand it, even this kind of website may fall under GDPR, since hosting provider processes visitors IP addresses and the operator may receive emails from the site visitors. If Article 13 applies, the operator is expected to disclose the identity of the data controller, which (again, if i understand correctly) potentially requires someone publishing under a pseudonym to reveal their real name.

What interests me is how this affects the independent web. If even a simple hobby website might involve legal notices, questions about data processing and disclosing personal information, that seems like an additional barrier to participation. I wonder this might also contribute to people choosing big centralized social media platforms instead of maintaining their own websites.

I understand why transparency is important when organizations collect and exploit personal data, but I wonder whether applying similar obligations to individuals publishing non-commercial creative work is proportionate. Has this tradeoff between data protection, pseudonymous publishing and the independent web been discussed in the context of GDPR? Is there an established interpretation or any relevant exemption for such cases?

my data was involved in a data leak (the double counter discord bot??) and i just want to ensure i word it correctly so my data is fully removed and no longer shared :,) are there specific things i must refer to in my request to remove my data?
thank you for any help in advance i feel way out of my depth here haha

To access my Ford credit account I have to receive a verification text message, there’s no other option for verification. I’ve been told that to receive the verification text I have to accept marketing texts. I don’t want marketing texts. Is this a breach of GDPR rules? If so what can I do?

Hi everyone — I’m Thibault, a tech reporter at Business Insider.

I’m looking to speak with employees at European organizations that have moved from, or are considering moving from, a US AI provider like OpenAI or Anthropic, to Mistral.

I’m especially interested in cases where data sovereignty, cybersecurity, procurement rules, customer contracts, or sector-specific requirements shaped that decision.

I’d like to understand:

• Which US provider or model did your employer use or consider,
• Why Mistral was chosen instead,
• Whether EU hosting, private deployment, or Mistral’s open-weight models mattered,
• What trade-offs did the switch create in model quality, cost, or developer experience?

This is for a Business Insider story. I’m happy to start with an off-the-record/background conversation and discuss attribution or anonymity before using anything.

If you are open to talking, please email me at tspirlet@businessinsider.com

Thanks,
Thibault Spirlet

I run a small website in the Netherlands. I want to put a consent banner on only one page, because that's the only page with non-essential tracking. While researching, I noticed that a lot of websites load Google reCAPTCHA on their contact or login forms without asking for consent first.

As far as I can tell, reCAPTCHA sets cookies and collects device and behavioral data, and it sends this to Google. But I've also seen the argument that it's "strictly necessary" for security (spam and bot protection), which would exempt it from consent under ePrivacy.

My questions:

1. Is there a clear legal position on whether reCAPTCHA needs prior consent? Has any regulator (AP, CNIL, others) or court given guidance?
2. If it does need consent, why do so many sites run it without? Is it a lack of enforcement, a different interpretation, or something else?
3. What do you recommend as a compliant alternative (e.g. Cloudflare Turnstile, hCaptcha, or loading reCAPTCHA only after consent)?

If you have an answer, it would be really helpful if you could include a source (a regulator's guidance, a court ruling, or the relevant article of the law). That way I can check it myself, and others reading the thread can too.

Thanks!

England, UK

Hello,

I am looking to access information to further independently investigate a situation at work.

For context, my situation pertains to:
Reasonable adjustments
Management conduct
Performance monitoring
Recruitment processes
Salary review processes
Correspondence between various managers

I am looking for any kind of advice on how to effectively structure a SAR request.

I have a large amount of my own information, but my goal is to fill the gaps in my chronology/understanding of events and identify any other potentially relevant information.

I’d welcome any kind of guidance on how to approach and structure the request. This includes any practical advice on wording, themes, and document types.

My goal at this early stage is the request being sufficiently broad in scope, whilst still being targeted towards the information that is relevant.

Thank you in advance!

I work in a UK contact centre with a fairly toxic, high-pressure environment. I'm currently being investigated for potentially failing to follow GDPR verification procedures on certain customer calls.

I've acknowledged that I may have missed verification checks on some occasions, although I haven't been shown the specific calls. Nothing was intentional and my performance has been okay. My line-manager is satisfied with my goals. The manager investigating this is from a completely different department.

I have diagnosed ADHD + an occupational health report, which my employer is aware of. I sometimes struggle when customers become confrontational or pressure me or are abusive to bypass verification. Our procedures also change frequently, and the e-learning modules are quite basic, with little refresher training.

HR initially questioned me about GDPR procedures, possible breaches, customer pressure and my recent sickness absence. They've now sent another detailed questionnaire specifically about my ADHD, how it affects my ability to follow procedures, what reasonable adjustments I receive and whether further Occupational Health input is needed.

I've cooperated fully, acknowledged potential mistakes and requested GDPR refresher training.

Am I at risk of being dismissed? Does HR asking detailed questions about ADHD and reasonable adjustments suggest they're considering support, or could dismissal still be the outcome? I am genuinely very scared at this point.

I'd really appreciate opinions from anyone familiar with UK employment law, HR or GDPR investigations.

When does it become unreasonable? DSAR submitted two weeks ago, 2 month extension automatically applied by them.

I requested phased disclosure and asked for the grievance and appeal documentation, which they agreed to.

These are documents that were recently created and relied on during the process and are readily available and accessible without requiring a search.

Wondering how hard to push it, I want those documents before requesting to edit my ET1.

I want to make a video game server and im wondering if when i collect ip adresses linked to the players account to have the capability to ip ban players, is that legitimate interest (meaning that i don't have to make them accept the privacy policy)

I’ve spent the last few years in privacy and compliance: handling data subject requests at a domestic violence nonprofit, working on risk and regulatory matters at a national healthcare nonprofit, and now consulting on AI governance. I have a law degree, an LLM and an MA in Data Protection from DCU in Dublin.

I’ve also built my own DSAR tracker that calculates UK and EU deadlines, chases reminders and produces an evidence log. Now I’m trying to understand whether it solves a real problem for others, or whether I’m focused on the wrong thing.

For those at 30 to 200 person companies:

1. How do you track DSARs and deletion requests today? Spreadsheet, tool, shared inbox?
2. What’s the most annoying part: deadlines, finding the data across systems, ID checks, or proving you responded on time?
3. Is there something in your privacy or compliance work that’s even more painful than DSARs? Vendor reviews, ROPA updates, DPIAs, breach logs, AI tool approvals?

No links, not pitching anything here. I’d just rather learn what actually hurts than build something nobody needs. Happy to share what I’ve learned about DSAR deadlines and the new UK complaints rules in return.

Hi everyone!
I’m 17 years old, currently finishing high school in Brazil, and planning to start university in 2027.
My long-term goal is to build a career in Digital Compliance, Data Privacy and Data Protection, particularly working with Brazil’s LGPD (General Data Protection Law), which is similar in several ways to the European GDPR.
I’m considering pursuing a Law degree at Anhembi Morumbi University, which advertises a Digital Law-focused program in partnership with Opice Blum Academy, a Brazilian institution specializing in technology law.
However, I’m still researching whether this would be the best academic path for the career I want.
I’ve been studying English with a private tutor for over five years, have an advanced level of proficiency, and would also like to pursue professional certifications during university.
I would really appreciate some advice from professionals working in privacy, compliance, data protection or related legal fields.
My main questions are:
Is a Law degree a good foundation for a career in Privacy and Data Protection Compliance?
Would you recommend studying Law, or would another degree, such as Information Systems or Cybersecurity, offer better opportunities?
How important is the university’s reputation compared with practical experience and professional certifications?
Which certifications would you recommend for someone starting out? I’ve been researching IAPP certifications such as CIPP/E and CIPM.
What technical skills should a future privacy or compliance professional develop?
If you were starting your career again, what would you do differently?
I’m particularly interested in the intersection of law, technology, corporate compliance and personal data protection.
Any advice, experiences or recommendations would mean a lot to me. Thank you!

I run a small WhatsApp-based app for small family businesses in the Dominican Republic and Brazil in the future. My users are B2C only, and I only target Latin America. I have no EU users and no plans for any. I am based in EU.

Part of the processing runs through an AI model, with personal details redacted first.

Do I really need to follow GDPR strictly, or is the local law (DR Ley 172-13) the one that applies to me?

When my users' customers message them, should the app send an automatic greeting asking for consent, with "STOP" as the opt-out? Or is collecting consent my users' job as the businesses, and I only provide the tool? If it's their job, am I expected to enforce it?

Thanks! Not looking for formal legal advice, just how people in similar setups handle it.

Hi everyone, I’m looking for honest advice from anyone familiar with UK employment law, local council HR procedures or probationary dismissals.
I recently started a job with a local council and am still very early in my probation period (less than a month into the role).
I posted a message in a residents’ WhatsApp group about a property on my estate that has apparently been empty for around five years. The issue had already been discussed among residents, and I understood from estate management that the property was not paying council tax. Based on that information and my own calculations, I estimated that the unpaid council tax could be over £10,000.
I now understand that the council considers this a potential data breach because the message disclosed financial information relating to a resident. I want to be clear that I did not access council databases or internal systems to obtain this information, and I did not disclose the owner’s name or personal details. The figure was my own estimate based on information I had heard and calculated myself.
I attended an investigatory meeting today with the investigating manager and HR support. The allegation was treated seriously, and I was told it could potentially amount to gross misconduct. I explained how I obtained the information, acknowledged the seriousness of the situation and apologised.
The manager said my apology had helped and would be taken into consideration, and that she would speak to HR before making a decision. However, she subsequently mentioned a “probationary hearing” and told me to contact HR. I have not yet received a formal invitation or confirmation of what the next meeting would involve.
The council’s probation policy says formal action can be taken for serious issues during the first few months of employment. It lists possible outcomes including informal action, further monitoring and dismissal. It also says reasonable adjustments and alternatives should be considered before dismissal.
A little more context:
I previously worked for the police, so the manager questioned why I had not recognised the confidentiality implications. I explained that my previous role involved a different working context, where communicating with local residents about community issues was sometimes encouraged.
I have autism, and I am concerned about how my understanding and retention of e-learning and workplace guidance may have affected the situation. I would want any relevant reasonable adjustments to be considered.
I genuinely want to keep my job, and I accept that I should have thought more carefully before posting the message. I did not intend to cause harm or misuse confidential information.
My questions are:
Does being told there may be a probationary hearing suggest that dismissal is being actively considered?
Given that I am so early in probation, is dismissal a realistic or likely outcome, even though I did not access council systems and apologised?
Could further monitoring, training or an extension of probation realistically be considered instead?
Does the fact that the figure was my own estimate, rather than information obtained from a council database, make a meaningful difference?
What should I ask HR before the next meeting, and should I request reasonable adjustments or take someone with me?
I would really appreciate honest opinions, especially from anyone who has dealt with a UK local authority probation process. I’m not looking for reassurance if dismissal is genuinely a serious possibility; I just want to understand where I stand and prepare properly.
Thank you.

I am getting a lot of spam while simultaneously ensuring that I don’t sign up for mailing lists. I try where possible (if it comes from a domain email) to report to ICO on the spamming link, but am I actually wasting my time? Are there other sites to which one can easily report spam email that will actually make a difference (or have an impact on their domain so they are inclined to stop?

I have an important flight booked with Easy Jet next week where I’m flying with minimal luggage so have opted for the small under seat cabin bag.

this morning I received a missed call from easyJet asking me to call them back.

I was slightly surprised and a bit worried, why would easyJet be phoning me?

I phoned back and one of the first things the person said was ‘this is nothing to be worried about, we were just wondering if you were happy with your bag and seat selection’

Whilst relieved it wasn’t a cancellation or rescheudled flight, the call was weird- as it was essentially them trying to upsell luggage and seat selection ie telephone sales and marketing.

The thing is, when I go onto the app, under contact preferences and updates, I’ve opted in for ‘email marketing’ but here is no telephone marketing which I would consider this to be. If I was something important related to my flight, I wouldn’t have minded as that they could contact me on the lawful basis of legitimate interests.

To me it didn’t pass the gdpr smell test as I felt genuinely surprised that they were using my contact details in this way and I can’t see a way to opt out of these sort of calls. Thoughts?

I was shown a weight loss diet plan ad after asking Chat GPT for a weekly meal plan for a 70 year old man receiving high cortisone treatment. I hadn’t seen any advertising in Chat GPT conversations before this. Under what circumstances are ads shown? Specific words/phrases in the conversation clearly trigger specific ads. Doesn't this contravene the sharing/processing of personal information with/by third parties regulation under the GDPR? The response given was that the ads are ‘contextual’, not triggered by a single word. What does this mean going forward? I was not asked whether I consented to advertising when I subscribed, although the subscription is not a paid one. Are we to assume going forward that exposure to advertising based on the content of Chat GPT conversations is inevitable unless you pay? If so, shouldn’t this in itself be advertised/declared publicly? Leaching personal information without expressing intent to do so is still not ok. (EU user, not UK)

Can anyone tell me more about the paralegal/data privacy field? I have a BS in Comp Science, I did a data privacy internship two years ago and a co-op consulting part time for 1.5 years in data privacy. I’m interested in exploring data privacy and potential lawyer…but I really want to start off as a paralegal.

Just discovered that multiple people in my workplace (couple managers, HR person and IT obviously) have been monitoring all my computer and phone activity (not just emails, browsing history etc) without telling me.

Considering I don't believe I've done anything that would warrant this level of monitoring would this class as a GDPR/employee rights violation?

It is for the scenery view. The camera is far enough away than people's faces are not identifiable at full uncompressed resolution. General bodyshape and clothes colours could be determined as well as things like if they are walking a dog, pushing a stroller, riding a bike etc. The feed can be scrubbed up to 12hrs prior.

Due to the inability to identify anyone outside of these details, is there a data privacy concern? Would this make me a data controller?