ComplyDog Blog

Server logs almost always contain personal data, which makes logging a processing activity that needs a basis, a retention period and a ROPA entry.

Posted by Kevin Yun | 2026-08-29T18:00:33.434Z

You do not have to surgically edit backups to honour an erasure request. You put the data beyond use, and let your retention cycle finish the job.

Posted by Kevin Yun | 2026-08-28T15:52:58.207Z

GDPR has no data residency rule. It regulates how data moves, not where it sits. The pressure to store in the EU almost always comes from contracts.

Posted by Kevin Yun | 2026-08-28T15:49:15.451Z

Office CCTV is lawful under GDPR, but consent is the wrong basis and signage alone is not notice. Retention and access requests are where it breaks.

Posted by Kevin Yun | 2026-08-27T18:46:23.340Z

Portability is narrower than access. It only covers consent and contract processing, and only data the person provided, including what you observed.

Posted by Kevin Yun | 2026-08-27T18:43:00.901Z

Article 22 is a prohibition with three exceptions, not a right people have to claim. It also catches ordinary rules engines, not just machine learning.

Posted by Kevin Yun | 2026-08-26T18:47:02.048Z

Pseudonymised data is still personal data and fully in scope. Anonymised data is outside GDPR entirely. The test is not whether you hold the key.

Posted by Kevin Yun | 2026-08-26T18:44:48.545Z

Session replay can be lawful, but two separate rules apply: consent to run the script, and a lawful basis for the recordings it produces.

Posted by Kevin Yun | 2026-08-25T18:34:38.467Z

You can monitor employees under GDPR, but almost never on consent. The test is necessity and proportionality, and the answer changes by country.

Posted by Kevin Yun | 2026-08-25T18:30:57.115Z