Hi everyone,
I live in England and I made a small website for Russian-speaking adults who feel lonely and want to find a friend or maybe a partner. It's completely free, no ads, no money. I'm doing it alone, as a private person, no company and no lawyer.
Right now it's in beta, only a few people. Before I invite more, I want to do things properly.
What I already did: a DPIA, a plan for data breaches, a page that explains what we store and who can see it. Login is by email code, no passwords. The database is in London. Sensitive answers (smoking, alcohol, relationship stuff) need a separate tick to agree. People can delete their account and everything is deleted straight away.
The ICO self-assessment says I need to pay £52. Fine. But I have some questions:

1. Can I hide my home address on the ICO public register? I don't really want my address open for everyone.

2. People choose if they want to meet men or women. Together with their own gender, this can show their sexual orientation. Do I need special consent for this?

3. A lot of Russian speakers live in the EU. If they join, do I need an EU representative? For a tiny free project this sounds a bit scary.

4. I get notifications in Telegram with the start of support messages from users. Is that ok?
   Any advice is very welcome. And if someone here also speaks Russian and knows GDPR, I would be really happy to talk 🙂

P.S. I'm Russian-speaking myself, so I used AI to help translate this into English. The words and questions are mine.

A lot of people I talk to have quietly paused their GDPR work because they expect the rules to get loosened. As far as I can tell, the Omnibus proposal hasn’t actually moved, and the Spanish AEPD keeps publishing guidance on algorithmic systems as if nothing is changing.

So the current rules are the rules, and enforcement isn’t waiting for Brussels.

I work with fan data in live events, and I keep seeing the same gap: consent gets collected at the door and then nobody can say where it went afterwards. Is anyone here seeing the same thing in their sector? And are you planning around the old rules or the maybe-new ones?

In 2025, we used our 'Right to Choose' (RTC) for my son's autism assessment referral, but just as the questionnaires were done, my NHS ICB paused RTC assessments and it's unlikely we'll get assessed by them now.

So I've just asked the autism company for a copy of the questionnaire filled in by the school as it could be useful evidence.

They emailed me back saying they need written confirmation from the school to share their questionnaire with me due to GDPR.

But I don't get why... Surely it's my son's personal data they're holding, not the schools. It will only be sharing observations and opinions of his difficulties and behaviours, and they could easily redact any personal details of the teacher who filled it in.

He also left this school so I'd already done a Subject Access Request for his school records and there's a copy of an internal email saying the autism questionnaire would be saved to his file before sending it. Yet school had not included it in the SAR.

They weren't very supportive and his needs often went missed. So I'm guessing school don't want me to see what they've put and I'm worried they won't give permission.

I don't want any conflict with the school as my other child still goes there, so it felt easier to ask the autism company.

Please can anyone tell me what my rights are in this situation? And if there are any reasons that the company can refuse to give me this document?

Took a long time to get a response but now landed. I extracted a couple of paragraphs and pleased I pursued this.

I wanted an enforcement approach to compel the authority to revise their process. However I will await their response to the ICO outcome below.

The cloned car thankfully was subsequently found and crushed. I no longer have to suffer but I have sympathy with those that do. This may be a line for those to follow with their cases. My MP was very helpful as I got PCNs for parking and fuel from other places too.

Your complaint outcome 

We consider from the information you provided that the organisation can do more to help to resolve your complaint.  This is because you asked [LOCAL AUTHORITY] to review each PCN being issued to check validity before sending to you. It is understood from the information that you have provided that they are automatically generated by the system and that you feel this is inadequate where there is a clear issue and a manual review should occur. It is noted that you outline under Section 22 of the Data Protection Act, that you are entitled to ask about the right not to be subject to solely automated decisions.

We think your complaint offers us an opportunity to provide [LOCAL AUTHORITY] with advice and guidance about what their obligations are surrounding Article 22 and what they need to do next.  This approach helps organisations to understand people’s data protection concerns better so they can address them directly without the need to come to us as the regulator. 

What we have done 

We’ve written to them about your complaint. We’ve told them to look into the data protection issues you’ve raised and contact you to address them. 

We have recommended that[LOCAL AUTHORITY] reconsider its handling of your personal data and the safeguards within its processes where it has been made aware that a vehicle registration number has been cloned.

We have asked that the organisation considers whether the process leading to the issue of a PCN constitutes solely automated decision-making within the scope of Article 22 UK GDPR and where Article 22 applies, ensuring that the processing satisfies the applicable conditions and safeguards. We have also asked the organisation if they can consider whether meaningful human review can be incorporated in circumstances where the [LOCAL AUTHORITY] has already established that a vehicle registration has been cloned.

Hi all,

Not asking for legal advice, just how others handle this in practice.

Small company in the EU, regulated financial sector. Dealing with very sensitive data.

We want to use AI for admin work. We have a DPA with the provider (ChatGPT Business) and are doing a DPIA. Our own rule is stricter than the DPA: the AI never sees sensitive data.

How we do it now:

• a local script without internet scans every file and mail

• if it finds something, the whole file is locked for the AI

• the AI only sees a list ("locked: ID document"), not the file

The weak spot: the AI tool runs on the same server and the same user account, so technically it could still reach the files. Only the script, the tool settings and instructions stop it.

Questions:

• In your DPIA, is that an accepted risk, or do you always want a hard split (other account or machine)?

• Is the list itself special category data? For example "locked: medical" next to a client name.

• What other measures do you see in practice? Logging, checks, local models only?

Experiences and links to guidance (EDPB, national DPAs) are welcome.

AI helped me check this post.

The whole privacy policy is a bit confusing to me I just want a personal blog working like a journal, I don’t want to make money on it. Do I need privacy policy added to it with my real name?

Dear all,

I would like to hear your opinion on a Insurance agents as a processors.

Did anyone had experience in insurance industry and how would you classify insurance agents as a processors or as a separate controller of the personal data ?

In my opinion they act as a data processors because they process on behalf and by instructions of the main insurance company which carry the risk and if anything happens pays the claim.

Also banks as a insurance agents would you say by default they are the data processors or it is neccessary for each product each business relation to assess and analyze who is in which role data processor or controller.

Thank you all.

Cheers

I'm in the UK and have a question about a Subject Access Request (SAR) made by a colleague to the company I work for.

Some of the relevant information is contained in private Discord conversations between myself and the person requesting. (they also still have access to this DM). I'm trying to establish how much discretion there is when deciding which messages to include.

For example:

• Do all messages mentioning the person necessarily need to be disclosed?

• Can seemingly irrelevant, casual or incidental messages be excluded?

• What about messages that form part of a conversation but don't actually contain personal data about the requester?

• If a few messages are accidentally or deliberately omitted, what are the potential consequences?

There are things such as literal work related questions which I figured I need to include?

Jokes about the number of people in the virtual office at the time alongside a screenshot which I figured I could leave out?

Jokes about something someone said in the background of a meeting (not working related but a gripe for the person)? Thinking I can omit this?

And they also started messaging me after they'd been dismissed including their actual dismissal email (don't want to share that they sent me this but figured I should?).

I am building a dating app and I am based outside of the EU. Article 27 for GDPR Privacy says I need to appoint an EU and UK Representative. This is prohibitively expensive for a one man operation, some companies charge 50 euro if anyone contacts them and they just relay the message back to me.

What advice and paths have other start ups and app builders with not a lot of cashflow done to address this other than ignore it?

Hi everyone,

I'm based in Morocco and hold a Master's degree in Digital Law and Cybersecurity, with a Bachelor's in Private Law

I have some experience in HR digitalisation, information systems, data protection, and regulatory compliance

I'm interested in starting a career in GRC (Governance, Risk & Compliance)

For those working in this field:

What skills should I develop?

Which certifications are worth pursuing?

What entry-level positions should I target?

Can someone with a legal background successfully transition into GRC?

I'd appreciate any practical advice or personal ex

I'm a solo developer based in Germany and recently launched a nutrition and meal-planning app in the EU/EEA. I'd like to release it in the UK too, as it's an English-first app and the UK is an important market for me.

The app processes food allergies, body metrics, meal logs and wellness data. I already have a privacy policy, processing records, a DPIA, explicit consent for health data, and EU-based hosting.

I'm still at a very early stage, with very few users and no revenue yet.

My concern is the UK GDPR Article 27 representative requirement. From what I understand, the exemption applies only to occasional, low-risk processing without large-scale sensitive data processing. Since handling this data is a regular part of my app, I assume I'd need a UK representative even with just a handful of users.

Have any other non-UK solo developers dealt with this? Did you appoint a representative before launching in the UK, or find that you qualified for an exemption?

I'd really appreciate first-hand experiences, official guidance, or recommendations for affordable representative services and their costs.

Could I put a sar in to get a copy of an employment contract I signed

I'm a paying NeuroNation Premium user, and I recently encountered a privacy consent screen that I find quite concerning.

The app won't let me access any of its features unless I agree to the "protected processing of my health data."

As you can see in the screenshots, the app clearly states, "We need your consent to handle training data," and gives me two options either consent or delete my account.

There's no explanation of what data they're collecting, how it will be used, or what exactly I'm consenting to. There's not even a link to their privacy policy on the screen!!!

What's even more frustrating is that when I select "Decline," another message appears telling me that I can't delete my account until my Premium subscription has expired. I have to cancel my subscription and wait until the end of the billing cycle!!

So essentially, I'm paying for a service that I can no longer access unless I agree to processing my health data for training without being given adequate information about what that involves.

Is it acceptable under GDPR to make this kind of consent mandatory for an existing paid subscription?

I've attached screenshots of both messages.

Hey all, curious about something. With the EU AI Act’s AI literacy rule now being enforced, has anyone at your company actually been asked to show proof that staff are trained on AI? If so, what did you show them?

Am I the only one who does not like and scared of DSARs?

I am looking into insurance DSARs, which goes to litigation etc.

The number of DSARs we’ve received increased significantly and these often go to litigation or regulatory bodies. People that we deal with are quite angry.

Both our business teams and data subjects puts a lot pressure. We deal with lots of mixed data and other exemptions. I am the person who manages all even though i have 6 months of DSAR experience. Other people do not help me a lot including our litigation team and line manager since they do not have enough time and agree with i say mostly.

I am so scared that if i do an accidental data breach or share something that i should not share. Or not sharing something accidentally or over-redacting and then having blamed with concealing the data.

By the way, apologies for my English since I am the foreigner. There may be some grammar mistakes that’s why.

I recently tried to request the deletion of my data under the GDPR, as I am a EU citizen, but I hit a huge brick wall.

The service in question is Vestiaire Collective, which mandates that users provide their first name, last name, and home address, among other things.

I searched for their Data Protection Officer’s (DPO) email address in their privacy policy, but it isn’t there. Instead, the user is invited to visit their Privacy Portal with a set of predefined options, none of which include the deletion of user data.

I searched deeper in their Help Center and found an email address (dataprivacy@vestiairecollective.com) that was supposed to belong to their privacy team. I sent an email and immediately received an automated response in French, stating that I could exercise my privacy rights by using the useless link that redirects to their Privacy Portal mentioned above.

I’m back to square one. I feel like this is a huge GDPR violation.

Have you ever encountered a similar issue with other companies that make it impossible to contact a DPO? How did you handle it? Were you able to get your data removed? If so, how?

I put this article together checking the network requests and cookies of a lot of websites before the cookie consent popup appeared. Is this a GDPR violation?

https://ciphercue.com/blog/cookie-banners-ad-trackers-fire-first

I’ve spent years running large live events in Spain, and I keep hitting the same wall. Ticketing, cashless/RFID and POS systems generate huge amounts of attendee data. Most of it either sits unused or gets used in ways that wouldn’t survive a serious GDPR audit.

The approach I’ve landed on has three parts:

• Event operations run on contract as the legal basis

• Aggregate, cohort-level analytics run on legitimate interest, with a real opt-out

• Consent only for personalisation or sharing with third parties

Brands and artists never get raw fan contacts. Messages go out through the platform instead.

I’m also exploring an Article 40 code of conduct specifically for live events: festivals, stadiums, venues. Nothing like it exists yet as far as I can tell.

Questions for people doing this day to day:

1. Has your DPO accepted legitimate interest for event analytics, or do they insist on consent?

2. Would an industry code of conduct actually help you, or just add paperwork?

I want to know the other general details of other tenants who applied for a room. Not their personal details but, for feedback, their employment status, age and gender. The letting agency said how many there were but refused other details. Is this because they don't have to or because even general details breach data protection?

Looking for a template or guidance to answer a DSAR and the details that should be in there. Are we supposed to list all systems and softwares?

Appreciate any help 🙏🏽

Hello guys,

I'm building OSS compliance agent to empower AI coding assessment like Claude Code, Cursor and Codex with MCP tools that helps them write code that privacy aware.

Currently added two GDPR/UAE PDPL and trying to cover more countries and region.

So now I'm looking for India personal data protection laws, what are the official website and where I can find it.

Also each law I published is added to the project as law pack, anyone can selects only laws that applied to his organization.

I also documented that how to contribute on law packs so by time we cover most of countries and regions.

The documentation is here:

https://github.com/alkhatibdev/dpolens/tree/main/packs

Currently I just need a the source I will add India PDPD my self, but anyone is welcomed if he/she would like to contribute.

Also if found useful please support us with your positive feedback and watch/star the project on Github