The right to data portability is one of the most “digital” rights granted by the GDPR — and one of the most frequently confused. It lets a person retrieve their data in a machine-readable format and move it to another provider, without having to re-enter everything from scratch. Its purpose is to increase users’ control […]
Legitimate interest under Article 6(1)(f) GDPR is one of the six legal bases for processing personal data — and the one most often misused. Controllers reach for it whenever they would rather not ask for consent and see no other basis, treating it as a “default” fallback. That is a serious mistake. Relying on legitimate […]
The right to erasure — commonly known as the right to be forgotten — is one of the most well-known and simultaneously most frequently misunderstood rights under the GDPR. Many individuals believe they can demand the deletion of their data in any situation, and the controller must comply immediately. Conversely, many companies refuse deletion requests […]
Privacy by design (data protection by design) and privacy by default (data protection by default) are two principles that the GDPR elevates to the status of legal obligations. Article 25 GDPR requires the controller to take data protection into account at every stage of designing systems, products, and processes — not as an afterthought, but […]
Selecting the correct legal basis for processing personal data is one of the most important decisions a data controller makes — and simultaneously one of the most common causes of violations identified by UODO. An incorrectly chosen legal basis can render the entire processing activity unlawful, even if the organisation meets all other GDPR requirements. […]
Since the GDPR came into force in May 2018, the President of the Polish Data Protection Authority (UODO) has imposed dozens of administrative fines on Polish companies and public institutions. The total amount of fines is growing year on year — and an analysis of UODO decisions provides valuable insights into which mistakes most frequently […]
The Record of Processing Activities (ROPA) is one of the fundamental documents required by the GDPR. It is an internal inventory of all personal data processing activities within the organisation — a “data map” that shows what data is processed, for what purpose, on what legal basis, to whom it is disclosed, and how long […]
Every company that uses external service providers processing personal data on its behalf — an accounting firm, a hosting provider, a CRM system vendor, a marketing agency, an IT company, a cloud provider — is required to enter into a data processing agreement (DPA) with that entity. This obligation arises from Article 28 of the […]
The information obligation is one of the cornerstones of the GDPR and, at the same time, one of the most frequently mishandled requirements. Every company, institution, and organisation that processes personal data must inform the individuals concerned — and that information must meet strictly defined requirements. The document conveying this information is commonly referred to […]
The General Data Protection Regulation (GDPR) is the most important piece of legislation governing personal data protection in Europe. It has been in force since 25 May 2018 and applies to virtually every company, institution, and organisation that processes the personal data of individuals in the European Union. This guide explains the key aspects of […]