GDPR

GDPR Art. 4(11) requires consent to be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action. A pre-ticked box records the controller's choice, not the person's act, so Recital 32 excludes it.

Under GDPR Art. 15, the person gets confirmation that their data is processed, a copy of it, and context: purposes, categories, recipients, retention, source, rights and automated decisions. Art. 12(3) requires a reply within one month of receipt, extendable by two further months.

GDPR Art. 6(1) lists consent, contract, legal obligation, vital interests, public task and legitimate interests. None ranks above the others; consent fits only when the person has a real choice, because it can be withdrawn and processing must then stop.

Yes. A hashed email is a stable identifier that anyone holding the address can recompute and match, so under the GDPR it is pseudonymised data, which Recital 26 treats as personal data. Only data rendered anonymous leave the Regulation's scope.

Under GDPR Chapter V, a transfer needs an adequacy decision (Art. 45), or appropriate safeguards such as SCCs or BCRs (Art. 46), or, as a narrow exception, an Art. 49 derogation. The rest of the Regulation must be met too.

Under GDPR Art. 33(1), the controller notifies without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The notice gives at least the Art. 33(3) items and may be completed in phases.

Under the GDPR the theft is still a breach and is recorded. With effective encryption, an uncompromised key and another copy of the data, it is usually unlikely to cause risk, so neither the authority nor individuals are notified.

Under GDPR Art. 7(3), withdrawing consent must be as easy as giving it, at any time. Processing before withdrawal stays lawful, but processing based on that consent must stop, and data with no other lawful basis should be deleted.

Under GDPR Art. 6(1)(f), the bank must show a legitimate interest (Recital 47 names fraud prevention), that the screening is necessary for it, and that customers' interests and rights do not override it, and document that assessment before screening starts.

Under the GDPR, whoever determines the purposes and means of processing is the controller (Art. 4(7)); a party processing on the controller's behalf is a processor (Art. 4(8)); parties that jointly determine purposes and means are joint controllers (Art. 26).

Very likely yes. GDPR Art. 3(2) reaches a non-EU company whose processing relates to offering services to, or monitoring the behaviour of, people in the Union, and product analytics monitors behaviour. Art. 27 then generally requires an EU representative.

Under GDPR Art. 83(5)(c), infringing the transfer rules (Arts. 44-49) risks up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. For a group, turnover is that of the whole undertaking under Arts. 101-102 TFEU.

Under the GDPR, making EU-hosted data viewable by a contractor in India is a transfer. Absent an adequacy decision, it needs Art. 46 safeguards, typically SCC Module Two with a Clause 14 assessment, plus notice to customers.

Under ePrivacy Directive Art. 5(3), storing or reading information on a user's device needs prior consent, to the GDPR standard, unless strictly necessary for the requested service. The banner must obtain an active, informed, granular choice before non-essential cookies are set.

Under GDPR Art. 17, data must be erased without undue delay where a ground applies, except to the extent an Art. 17(3) exception covers it: invoices kept under tax law (point (b)) and dispute records needed for legal claims (point (e)) stay; the rest goes.

GDPR Art. 9(1) lists data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, plus genetic, identifying biometric, health, and sex-life or sexual-orientation data. Criminal data fall under Art. 10; bank details are ordinary personal data.

Under GDPR Art. 37(1), a DPO is mandatory for public authorities, and where core activities involve large-scale regular and systematic monitoring or large-scale special-category or criminal data. A CTO is a poor fit: Art. 38(6) bars conflicting duties.

Under the GDPR, a consent request inside terms of service must be clearly distinguishable (Art. 7(2)), and tying a service to consent for unnecessary processing undermines freedom (Art. 7(4)). A bundled newsletter checkbox fails both, so the consent is invalid.

Under GDPR Art. 8, where an online service offered directly to children relies on consent, a child under 16, or a lower national age not below 13, needs parental consent or authorisation, verified with reasonable, risk-proportionate efforts.

Under GDPR Art. 7(1), the controller must be able to prove consent. A record should show who consented, when, how, what information and wording they saw, for which purposes, and any later withdrawal, without collecting more data than that proof needs.

Under GDPR Art. 12(6), a controller with reasonable doubts may ask only for the extra information necessary to confirm identity. Requests are free; under Art. 12(5) it may charge a reasonable fee or refuse only manifestly unfounded or excessive ones, and must prove that.

Under GDPR Art. 21(2)-(3), a direct-marketing objection is absolute: that processing stops, with no balancing. Other objections under Art. 21(1) rest on the person's situation and yield to compelling legitimate grounds; Art. 18 restriction limits data to storage while that is checked.

Under GDPR Art. 20, portability covers personal data the subscriber provided, processed on consent or contract by automated means, delivered in a structured, commonly used, machine-readable format. Scores the service computes and data processed on other lawful bases fall outside.

Usually not. Under GDPR Art. 6(1)(b), processing must be objectively necessary to perform the contract. A shop can sell and deliver without recommendations, so EDPB guidance treats that personalisation as outside the contract basis; another basis must carry it.

Heart-rate readings are data concerning health, a special category that GDPR Art. 9(1) prohibits processing by default. The app needs both an Art. 6(1) basis and one of the Art. 9(2) conditions, for a consumer app typically explicit consent under Art. 9(2)(a).

GDPR Art. 28(3) requires a written, binding contract describing the processing and committing the processor to documented instructions, confidentiality, Art. 32 security, sub-processor rules, assistance with rights and Arts. 32-36, deletion or return at the end, and audits.

Under Decision (EU) 2023/1795, only US organisations on the Data Privacy Framework List are adequate. The startup checks that the recipient is listed, current and covers the data type; otherwise it needs SCCs or another Art. 46 route.

Under the GDPR it is a confidentiality breach whatever the recipient does. A trusted partner's confirmed deletion may make risk unlikely, so no notice may be due, but Art. 33(5) still requires recording facts, effects and remedial action.

Under GDPR Art. 33(2), the processor notifies the controller without undue delay, with no risk assessment first. Per EDPB guidance, the controller is in principle aware once informed, and then owns the Art. 33 and 34 decisions.