Kevin Yun

GDPR does not require insurance, and a policy probably cannot pay your fine. What it does cover is the part that actually bankrupts small companies.

Posted by Kevin Yun | 2026-09-01T00:00:00.000Z

If it identifies a person, yes, and who pays for the mailbox is irrelevant. The line falls between named individuals and genuinely generic addresses.

Posted by Kevin Yun | 2026-08-31T19:03:08.429Z

For most website and SaaS operators, yes. The Court of Justice settled it in Breyer, and the test is what you could reasonably do to identify someone.

Posted by Kevin Yun | 2026-08-31T19:00:52.350Z

An NDA is a private promise about secrecy. A DPA is a statutory requirement under Article 28. One cannot do the other's job, and most deals need both.

Posted by Kevin Yun | 2026-08-30T18:03:11.524Z

Neither term appears in the GDPR. The law requires specific information under Articles 13 and 14, and the label you put on it is your choice.

Posted by Kevin Yun | 2026-08-30T18:01:21.814Z

Copying production data to staging is processing for a new purpose. It needs a compatibility assessment, and staging rarely has the controls to justify it.

Posted by Kevin Yun | 2026-08-29T18:02:53.132Z

Server logs almost always contain personal data, which makes logging a processing activity that needs a basis, a retention period and a ROPA entry.

Posted by Kevin Yun | 2026-08-29T18:00:33.434Z

You do not have to surgically edit backups to honour an erasure request. You put the data beyond use, and let your retention cycle finish the job.

Posted by Kevin Yun | 2026-08-28T15:52:58.207Z

GDPR has no data residency rule. It regulates how data moves, not where it sits. The pressure to store in the EU almost always comes from contracts.

Posted by Kevin Yun | 2026-08-28T15:49:15.451Z