Compliance strategy and regulatory guidance written by practitioners
Articles
Regulatory guidance and compliance strategy from those doing the work
An Irish energy operator, water utility or transport network sits in an odd position right now. The cybersecurity obligations it will be held to are effectively settled, its regul…
TL;DR: NIS2 comes down to three questions. Are you in scope - and if so, are you an "essential" or an "important" entity? What does it require - chiefly the Article 21 risk-manage…
There is tidy assumption behind lot of data-protection record-keeping: tool is tool, and once you have logged what data it holds, you have done the job. Add the vendor, the data c…
team stands up an AI tool, someone remembers it needs to go in the Record of Processing Activities, the entry gets written, and the box is ticked. The processing is documented. Ex…
Most conversations about shadow AI treat it as risk waiting to happen - an unapproved tool that might leak data, might train on something it shouldn't, might cause problem later.…
There is good reason financial firms automate their Record of Processing Activities. Maintained by hand, an Article 30 record goes stale the moment someone adds tool or reroutes d…
Three approaches to GDPR compliance under Article 30. The spreadsheet your team updates twice year. The OneTrust deployment your CFO will not approve. And third option that does t…
Your supplier questionnaire is not supply chain assessment. Most mid-market NIS2 compliance programmes have built something creditable around incident handling, access management,…
Your customer support team turned on sentiment analysis last quarter. The customer is not told. The customer's verbatim transcript may become training data for the vendor dependin…
Article 30 of GDPR has five required fields per processing activity. When an AI feature turns on inside an already-documented SaaS, three of those fields change, purpose, categori…
Marketing AI tools fall into four GDPR compliance categories, and most marketing directors do not know which of their tools sit in the highest-exposure category. Marketing has rol…
NIS2 Article 20 puts personal liability on the management body. The CISO is rarely on the management body. The CISO is the person who ensures the management body's NIS2 compliance…
Find answers to common questions about our content and updates
Monthly updates on regulatory changes, compliance trends, and platform releases
By subscribing you agree to our Terms and Conditions and Privacy Policy
