https://www.cybergdpr.org/en/blog Latest from Blog en Thu, 05 Nov 2026 20:44:16 GMT https://www.cybergdpr.org/en/blog/article-28-processor-contracts https://www.cybergdpr.org/en/blog/article-28-processor-contracts A security team's guide to GDPR Article 28: controller vs processor roles, the mandatory DPA clauses, sub-processors and a SaaS vendor due diligence checklist. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/data-minimisation-and-retention https://www.cybergdpr.org/en/blog/data-minimisation-and-retention Turn GDPR data minimisation and storage limitation into engineering: retention schedules, TTLs, partition drops, crypto-shredding, backups and test data. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/dpia-for-it-projects https://www.cybergdpr.org/en/blog/dpia-for-it-projects When a DPIA is mandatory under GDPR Article 35, the WP248 criteria, what the assessment must contain, and how security teams contribute to it. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/gdpr-and-nis2 https://www.cybergdpr.org/en/blog/gdpr-and-nis2 GDPR vs NIS2 for security teams: scope, security measures, 24h/72h/one-month reporting, authorities, fines and one incident process with two outputs. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/gdpr-article-32-security-of-processing https://www.cybergdpr.org/en/blog/gdpr-article-32-security-of-processing A practical reading of GDPR Article 32 for security teams: risk-based measures, points (a) to (d), control mapping, testing and the evidence you need. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/gdpr-breach-notification-72-hours https://www.cybergdpr.org/en/blog/gdpr-breach-notification-72-hours How security and IR teams handle GDPR Articles 33 and 34: when the 72-hour clock starts, risk assessment, phased notification, and the breach register. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/international-data-transfers https://www.cybergdpr.org/en/blog/international-data-transfers GDPR Chapter V for IT teams: adequacy, SCCs, BCRs, derogations, transfer impact assessments, remote access as a transfer and supplementary technical measures. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/pseudonymisation-vs-encryption https://www.cybergdpr.org/en/blog/pseudonymisation-vs-encryption Pseudonymisation and encryption under GDPR explained for engineers: Article 4(5), Recital 26, HMAC keyed hashing, tokenisation, key management and pitfalls. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/records-of-processing-activities https://www.cybergdpr.org/en/blog/records-of-processing-activities How security and IT teams build and maintain a GDPR Article 30 record of processing from the CMDB, asset inventory and data flows, with a YAML example. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybergdpr.org/en/blog/security-logging-and-monitoring https://www.cybergdpr.org/en/blog/security-logging-and-monitoring How to run security logging, SIEM, EDR and DLP in line with GDPR: lawful basis, employee monitoring, retention periods, access control and field masking. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT