Privacy, Data and Cybersecurity

Marketing and data together constitute one of the most dynamic and risk-sensitive domains of the digital economy. Data-driven marketing is no longer confined to the distribution of generic commercial messages, but encompasses a broad range of activities in which personal data, behavioural data, interaction data, preferences, location indicators, click behaviour,…

Cookies and ePrivacy constitute a particularly concrete, visible and testable domain within digital regulation, because they do not affect the user at a distance, but directly at the first point of contact with a website, platform, app or digital service. Whereas many obligations in the fields of data protection, cybersecurity,…

Engagement with data protection authorities is one of the most decisive tests of digital governance, because contact with a privacy regulator reveals whether an organisation merely regulates personal data formally or whether it actually controls, explains and operationally accounts for its processing activities. A data protection authority does not look…

The data controller occupies the normative, governance and operational centre of gravity within the GDPR for every processing of personal data. This is not a merely formal classification, but concerns the party that directs the processing, determines the purposes, selects the essential means, and bears responsibility for the lawfulness, proportionality,…

The data processor occupies a position under the GDPR that extends far beyond the traditional image of an external service provider performing merely technical acts. In a digital economy in which cloud infrastructures, SaaS platforms, managed service providers, data centres, cybersecurity suppliers, HR systems, payment processors, marketing technology and specialised…

The core principles of the GDPR constitute the foundational normative framework for any processing of personal data that must be legally sustainable, administratively explainable and operationally defensible. They determine not only the conditions under which data may be collected, used, shared, retained or erased, but also the degree of care…

The General Data Protection Regulation has not only tightened the legal framework for data protection, but has also made clear that digital legal protection only has real substance where the rights of data subjects are practically accessible, intelligible and enforceable. An organisation may have policies, registers, procedures and contractual clauses…

Privacy agreements and transactions form the contractual foundation for the management of personal data in digital cooperation models, outsourcing chains, platform environments, cloud-based services, technology partnerships and data-driven transactions. In a commercial reality in which personal data may move through multiple systems, parties, jurisdictions, suppliers and subcontractors, a privacy agreement…

New digital products and business models constitute a strategic intersection where commercial innovation, data protection, cybersecurity, supervisory expectations, consumer trust and board-level responsibility converge. In many organisations, digital innovation has long been assessed primarily by reference to speed, scalability, user growth, technical feasibility and commercial positioning. In a data-intensive economy,…

Data export is one of the areas of digital business operations in which legal permissibility, factual control, operational dependency and executive responsibility converge most sharply. Once personal data, commercially sensitive information, investigation data, client data, financial data, technical logging, metadata or security information are processed outside the direct European protective…