Florian Amette
Security engineer writing practical guides that translate the GDPR into controls, playbooks and evidence for security and IT teams.
A security team's guide to GDPR Article 28: controller vs processor roles, the mandatory DPA clauses, sub-processors and a SaaS vendor due diligence checklist.
Turn GDPR data minimisation and storage limitation into engineering: retention schedules, TTLs, partition drops, crypto-shredding, backups and test data.
When a DPIA is mandatory under GDPR Article 35, the WP248 criteria, what the assessment must contain, and how security teams contribute to it.
GDPR vs NIS2 for security teams: scope, security measures, 24h/72h/one-month reporting, authorities, fines and one incident process with two outputs.
A practical reading of GDPR Article 32 for security teams: risk-based measures, points (a) to (d), control mapping, testing and the evidence you need.
How security and IR teams handle GDPR Articles 33 and 34: when the 72-hour clock starts, risk assessment, phased notification, and the breach register.
GDPR Chapter V for IT teams: adequacy, SCCs, BCRs, derogations, transfer impact assessments, remote access as a transfer and supplementary technical measures.
Pseudonymisation and encryption under GDPR explained for engineers: Article 4(5), Recital 26, HMAC keyed hashing, tokenisation, key management and pitfalls.
How security and IT teams build and maintain a GDPR Article 30 record of processing from the CMDB, asset inventory and data flows, with a YAML example.
How to run security logging, SIEM, EDR and DLP in line with GDPR: lawful basis, employee monitoring, retention periods, access control and field masking.