Notes from the compliance frontline

Regulatory briefings, enforcement lessons, and field-tested guidance — written for the people who actually have to ship compliance.

Trending this quarter

01The EU Digital Omnibus: What the 2026 GDPR & AI Act Overhaul MeansRegulation · 11 min read 02The EU AI Act Is Here: A Practical Compliance Guide and How PrivacyForge Helps You Stay AheadGuide · 16 min read 03GDPR Data Retention: How Long Can You Keep Customer Data?Guide · 10 min read 04GDPR Enforcement: Landmark Fines and Lessons for Your BusinessNews · 7 min read 01The EU Digital Omnibus: What the 2026 GDPR & AI Act Overhaul MeansRegulation · 11 min read 02The EU AI Act Is Here: A Practical Compliance Guide and How PrivacyForge Helps You Stay AheadGuide · 16 min read 03GDPR Data Retention: How Long Can You Keep Customer Data?Guide · 10 min read 04GDPR Enforcement: Landmark Fines and Lessons for Your BusinessNews · 7 min read

RegulationJun 10, 2026 · 11 min readThe EU Digital Omnibus: What the 2026 GDPR & AI Act Overhaul MeansA verified breakdown of the EU Digital Omnibus — the cookie consent, breach notification, and AI Act changes coming in 2026, and how to prepare without ripping out your stack.PFMariyan ValevRead article →

GuideJul 16, 2026 · 14 min readAI Governance for Ecommerce: Vendor Risk, Bias Audits, and Incident ResponseA practical AI governance playbook for ecommerce operators: classify your recommendation and pricing engines, run an AI vendor risk assessment, meet EU AI Act Article 50 at checkout, and build an AI incident response plan.

GuideJul 15, 2026 · 13 min readWhat Is AI Governance? A Practical Framework for GDPR-Bound Ecommerce OperatorsUnderstand what AI governance is, how NIST, the EU AI Act, and ISO 42001 fit together, and how to build a practical program that satisfies GDPR — mapped for ecommerce.

RegulationJul 14, 2026 · 11 min readWeb Scraping and GDPR: 2026 Rules for eCommerce AIThe EDPB's new draft guidelines set the GDPR rules for scraping reviews, UGC, and web data to train eCommerce AI. Here is what stores must do before scraping.

RegulationJul 13, 2026 · 13 min readGDPR Anonymisation: Is Your Store Data Really Anonymous?The EDPB's 2026 guidelines redefine when eCommerce data is truly anonymous under GDPR. Learn the three-criteria test and audit your 'anonymised' datasets.

GuideJul 12, 2026 · 11 min readMarketplace Seller GDPR: Who Handles the DSAR?Selling on Amazon, Etsy and your own store? See who is the GDPR controller per channel and how to handle a DSAR when the marketplace holds the data.

GuideJul 11, 2026 · 13 min readDUAA and Automated Decisions: Fraud, Pricing and BNPLThe UK's DUAA rewrote Article 22 on automated decisions. Make your store's fraud scoring, dynamic pricing and BNPL checks lawful under the new rules.

GuideJul 10, 2026 · 12 min readDUAA & DSARs: The New 'Stop the Clock' Rule (2026)The UK's DUAA rewrote the DSAR clock. Learn how the new 'stop the clock' pause and 'reasonable and proportionate search' rules change how your store handles customer data requests.

GuideJul 10, 2026 · 12 min readEmail Tracking Pixels and GDPR Consent: CNIL's 14 July 2026 DeadlineCNIL's 14 July 2026 deadline turns email tracking pixels into a consent decision for eCommerce. Learn which pixel uses need consent, which are exempt, and how to fix your email platform in time.

GuideJul 8, 2026 · 11 min readGDPR Proof of Consent: How Long to Keep Consent Records (2026)GDPR makes you prove every customer consented. Learn what a defensible consent record must contain, and how long to keep proof of consent — even after you delete the data.

GuideJul 7, 2026 · 12 min readGDPR Data Breach Notification for eCommerce: 2026 GuideYour GDPR data breach notification duties: the 72-hour rule, the two-tier risk test, and what the EDPB's new 2026 template requires for eCommerce stores.

RegulationJul 7, 2026 · 11 min readGDPR Cookie Consent 2026: Why Banners Are Here to StayThe EU Council removed automated consent signals from the Digital Omnibus in June 2026. What this means for your cookie banner strategy — and what to do now.

NewsJul 5, 2026 · 12 min readEU-US Data Privacy Framework 2026: FTC Ruling Action PlanThe US Supreme Court's FTC independence ruling threatens the EU-US Data Privacy Framework. Here's your 5-step ecommerce action plan before Schrems III lands.

RegulationJul 3, 2026 · 14 min readGuest Checkout GDPR Rules: EDPB Says Make It the DefaultEDPB Recommendations 2/2025 make guest checkout the GDPR default. See why forced account creation rarely has a valid legal basis — and how to fix your store.

GuideJun 12, 2026 · 10 min readGDPR Data Retention: How Long Can You Keep Customer Data?GDPR sets no fixed retention periods, but keeping customer data forever is illegal. Learn how long to keep order, marketing, and account data — and how to prove it.

GuideJun 12, 2026 · 10 min readGDPR Data Processing Agreements: An eCommerce GuideEvery tool that touches your customer data needs a Data Processing Agreement. Learn the eight mandatory Article 28 clauses and how to manage vendor DPAs.

GuideJun 12, 2026 · 11 min readWhen Is a DPIA Required? 2026 Guide & New EDPB TemplateLearn when GDPR Article 35 requires a Data Protection Impact Assessment, how to run one step by step, and what the EDPB’s new 2026 template changes.

RegulationApr 21, 2026 · 13 min readGDPR and the EU AI Act in 2026: How the Two Rules OverlapA verified 2026 timeline of the EU AI Act, how it layers on top of GDPR, and what eCommerce and SaaS teams should do before the August 2 high-risk deadline.

GuideApr 21, 2026 · 12 min readGDPR International Data Transfers in 2026: DPF, SCCs, and TIAsThe EU-US Data Privacy Framework, Standard Contractual Clauses, and Transfer Impact Assessments — what eCommerce and SaaS teams actually need to document in 2026.

GuideApr 4, 2026 · 14 min readEU AI Act Article 50: Transparency Rules Your eCommerce AI Must FollowArticle 50 of the EU AI Act requires eCommerce chatbots, recommendation engines, and AI-generated content to meet specific transparency obligations by August 2026. Here is what to do.

GuideMar 11, 2026 · 22 min readInside the AI Governance Dashboard: How to Manage EU AI Act and UK ICO Compliance in One PlaceA feature deep-dive into PrivacyForge's AI Governance module — from registering your first AI system and classifying its risk tier to running bias audits, generating model cards, and monitoring regulatory alerts. Everything you need to go from "we use some AI tools" to audit-ready confidence.

GuideMar 11, 2026 · 20 min readGDPR Compliance for eCommerce: A Practical ChecklistA no-nonsense GDPR checklist built for online stores. Covers cookie consent, checkout data, email marketing, third-party processors, customer data requests, and cross-border sales — with the specific actions eCommerce teams need to take.

GuideMar 10, 2026 · 18 min readData Mapping 101: How to Build a Record of Processing Activities (ROPA)A step-by-step guide to mapping personal data flows across your organization and building the Record of Processing Activities required by GDPR Article 30 — with practical templates, common pitfalls, and automation strategies.

GuideMar 6, 2026 · 16 min readThe EU AI Act Is Here: A Practical Compliance Guide and How PrivacyForge Helps You Stay AheadThe EU AI Act reached full application on August 2, 2026. This guide breaks down the risk tiers, compliance obligations, key deadlines, and shows how PrivacyForge gives your team the tools to classify, audit, and document AI systems — before regulators come knocking.

GuideFeb 15, 2026 · 14 min readMastering GDPR Compliance in 2026: Navigating Reforms and Leveraging Tools Like PrivacyForgeAs GDPR enters a pivotal year with the Digital Omnibus proposal, AI Act integration, and tightening enforcement, learn how to stay ahead of reforms and transform compliance into a strategic advantage with tools like PrivacyForge.

RegulationFeb 9, 2026 · 11 min readAI and GDPR: Navigating Compliance Challenges in Machine LearningAs AI adoption accelerates, understanding how GDPR applies to machine learning models, training data, and automated decision-making becomes critical for organizations.

Best PracticeFeb 7, 2026 · 9 min readPrivacy by Design: A Practical Implementation GuideTransform privacy by design from a theoretical concept into actionable development practices. Learn how to embed privacy into your software development lifecycle.

GuideFeb 3, 2026 · 10 min readAutomating Data Subject Access Requests (DSARs) at ScaleHow to build an efficient DSAR workflow that meets the 30-day deadline, reduces manual effort, and ensures complete data retrieval across all systems.

Best PracticeJan 28, 2026 · 8 min readCookie Consent Best Practices: Beyond the BannerLearn how to implement cookie consent that is truly GDPR-compliant, goes beyond a simple banner, and respects user choice while maintaining analytics capabilities.

GuideJan 15, 2026 · 12 min readThe Complete Guide to GDPR Compliance in 2026Everything your organization needs to know about achieving and maintaining GDPR compliance, including the latest regulatory updates, enforcement trends, and practical implementation steps.

NewsJan 10, 2026 · 7 min readGDPR Enforcement: Landmark Fines and Lessons for Your BusinessA roundup of the most significant GDPR enforcement actions to date, what they mean for your organization, and how to avoid similar penalties.

The regulators move fast. Move faster.

Get the latest GDPR news, compliance tips, and expert insights delivered to your inbox every week.