Purpose & Means Newsletter — Issue 6, October 2026

1 — From the desk #

Field Talk is just three weeks away, and it is entirely self-hosted. The live stream, the video archive, the conference site, the speaker registration, the calendar bookings, the email to participants - none of it runs on a platform I do not control.

In recent years I started seeking out EU-sovereign, open-source alternatives to the US platforms most companies default to.

Over the past couple of years I have built a home lab — machines in my house in Copenhagen and bits of infrastructure at Hetzner in Germany - and migrated almost everything I use onto it. It has cost time. It has replaced licences. It has been more educational than any amount of reading about it could have been.

From this issue I am writing about it: What I have replaced, what it takes, and what I have learned by doing it rather than recommending it. The first instalment is at the bottom of this issue.

2 — Data Protection Hero #

How easy is it to understand the risks to the rights and freedoms of individuals?

Take a look at your own DPIAs.

3 — Main piece #

The DPIA everyone writes and no one uses - Part 6: Six sketches and no answer #

Part 6 of a short series. Just joining us? Part 1, Part 2, Part 3, Part 4 and Part 5 are here.

Five parts in, I owe you something.

In Part 1 I showed a rough mock-up of a radar and said a developed version would follow in a later issue. In Part 4 I said Part 5 would be the one about visualising risk. Part 5 arrived, made the case against the heat map, borrowed Cronk’s decomposition, looked at what the ICO wanted from Snap after five attempts, and landed on the DPIA as a living document. It did not show you the replacement.

This part is about why, and what I have instead.

Inspiration from elsewhere #

There is a framework from Jules Goddard that I keep returning to, and it is slightly unkind to our profession. Take a look at this simple diagram:

Four-box map from Jules Goddard / 42courses. Common nonsense — false and shared by everyone — is the most dangerous box.

You can see there are four boxes. Common sense, which is true and shared. Uncommon sense, which is true and yours alone, and which is where any real advantage lives. Uncommon nonsense, which is false and yours alone, and which is what holds you back. And common nonsense, which is false and shared by everyone, and which is the most dangerous box on the map, because nobody in the room is going to challenge it.

Goddard’s argument is that performance comes from removing common nonsense faster than everyone else. The line he quotes, usually given to Mark Twain, puts it better than I can: it is not what you do not know that gets you into trouble, it is what you know for sure that just is not so.

The likelihood-by-severity grid is common nonsense in data protection. It is taught, templated, loved by the big consultancies, shipped inside every GRC tool, and reproduced in DPIAs that will never be read. It is also, as this series has argued at some length, not an assessment. It is a judgement with a colour applied to it.

What the replacement has to do #

Before showing you anything, it is worth being explicit about what a replacement would have to achieve, because otherwise this is just picture-shopping.

Pulling together where the series has already been, I think there are six considerations.

It has to show the reasoning, not just the conclusion. The central failure of the heat map is that it records a judgement while hiding everything that produced it. The ICO’s patience with Snap ran to five iterations largely because it wanted to see the working.

It has to survive being read by a regulator who was not in the room, a board member who has five minutes, and a tech or engineering colleague who has to act upon it. Those are three different readers and not many DPIA artefacts serve them well.

It has to show who, and how many. A grid flattens a population into a single cell. Part 3 was entirely about the people at the edges of that population, and any honest visual has to keep them visible rather than averaging them away.

It has to be honest about uncertainty rather than hiding it behind a coloured square. This is the one that most risk artefacts fail hardest, because precision is what makes them feel professional.

It has to be revisitable. Part 5 ended on the living document. A picture that cannot be meaningfully redrawn in eight months, and compared with the last version, is a snapshot pretending to be a process.

And it has to resist false arithmetic. This is the trap. Any visual that invites you to multiply things together will eventually be used to multiply things together, and you will have rebuilt the heat map with better typography.

Where I went looking #

The design thinking move here is called analogous universes, and it is simple enough: stop looking at your own field, because your own field is where the common nonsense lives. Ask instead which other disciplines have had to communicate risk to people, under genuine uncertainty, to an audience without technical training, and look at what they drew.

That turns out to be a long list. Meteorology. Epidemiology. Environmental impact assessment. Actuarial science. Human rights adjudication. Aviation safety. None of them use a red-amber-green grid as their primary instrument, and several of them abandoned something like one decades ago.

The other rule from design thinking is to diverge before you converge, and to stay diverged longer than is comfortable. Pauling’s version is that to have a good idea you must first have lots of ideas. So there are six sketches here rather than one, and I am not going to tell you which is right, because I do not know.

Before you look at them #

These are drafts. I have drawn them in Excalidraw and deliberately left them rough, because a polished version would invite you to evaluate the polish rather than the idea.

The numbers in them are illustrative. They are there to give the shapes something to hold, nothing more. They do not reconcile with each other, and you should not try to make them: the population in one sketch is not the population in the next, and no single processing activity sits behind the set. A later version would use one worked example throughout. This one does not.

What I am asking you to look at is the shape of each instrument, and what it makes visible or hides. Not the arithmetic.

1. The radar #

Eight segments, one per harm category from the Citron and Solove taxonomy. Rings for severity after controls. Two dots per harm, filled for where you are and hollow for where you said you would be, with the gap between them being the actual subject of the assessment. Dot size for how many people are exposed.

What it does well: it makes concentration visible. You can see at a glance that several of your harm categories are clustered at the outer edge, which no table will ever tell you. It also makes coverage gaps visible, which is to say the segments where you have assessed nothing at all.

2. The cone of uncertainty #

Borrowed directly from weather forecasting, which is the only field I can think of that has genuinely solved the problem of showing a lay audience an honest range instead of a false point. Everybody understands a hurricane cone. Nobody needs it explained.

Applied here: harm over the life of the processing, with a median line and a visible band. The cone widens as you look further out, which is the honest shape, because you know less about year five than year one.

It only works if the numbers behind it are any good, which means calibrated estimates rather than plucked ones. That is a discipline in its own right and the series has not covered it yet. Hubbard and Seiersen’s work is the practical starting point, and the finding that ought to frighten anyone who has ever filled in a risk register is that people’s true values fall outside even their stated ninety-eight per cent confidence intervals roughly a third of the time.

3. The slope #

Three positions - inherent, residual, target - with one line per harm and a horizontal threshold for the risk appetite the organisation declared before the assessment started. Part 4 argued that appetite has to be set in advance, because deciding what is tolerable after you have seen the answer is not governance.

This is the sketch that most directly produces a decision. You can see immediately which harms close the gap and which do not.

Its weakness is that it says nothing about how many people are affected or who they are, so it would need to travel alongside something else.

4. The exposure stack #

Four tiers, narrowing. Everyone the processing touches. Those it can actually reach. Those with something to lose. Those it harms.

The typical DPIA says “consumers” and gives a number in the millions. This says that the number that matters is the one at the bottom, and that the interesting work is in the narrowing - who falls through each tier and why.

Note that three of the four tiers carry ranges rather than single figures. That is deliberate. If you can state the bottom tier to the nearest person, you are not measuring, you are asserting.

5. Gross population and at-risk population #

Seven groups of data subjects, drawn twice. The top row sizes each group by headcount: the gross population, which is the row your DPIA counts. The bottom row sizes the same seven groups by how many people in each are actually exposed.

The ranking changes. It does not simply invert, which is the interesting part. A group that sits third by headcount can be first by exposure. The large general population, which dominates the top row, can become one of the smaller figures in the bottom one.

Look at the smallest group in the bottom row. Fewest people, highest concentration - almost everyone in that group is exposed. A per-activity average would erase them completely, and a grid would never have shown them at all.

6. The statement #

No chart.

If the objection to the heat map is that a picture records a judgement while concealing the reasoning behind it, then the logically consistent response is to stop drawing and write it down. A short statement in plain language: the likelihood, the direction of travel, the estimated range of people affected, who they are, whether it can be undone, and whether anyone affected will ever find out.

I include this one because without it the other five are a pitch for a picture, and I do not trust myself on that :-)

The thing I keep coming back to #

Every one of these could become the next heat map.

Quantification changes behaviour, and what gets optimised is the measurement rather than the thing being measured. A radar that gets adopted widely enough will acquire a scoring convention, then a template, then a tool with the scoring convention baked in, and in four years a practitioner will be writing a newsletter about how the radar records a judgement without showing the reasoning.

The only guard I can think of is a rule rather than a picture: the visual never travels without the reasoning attached. The moment a chart can be lifted out of a DPIA and pasted into a slide on its own, it has stopped being an assessment and become a decoration. The heat map’s original sin was not that it was a grid. It was that it was portable.

So I am not proposing one of these. I am showing you six rough things and admitting that after five parts of taking something apart, I have not yet found the uncommon sense that replaces it.

Over to you #

If one of these looks useful, or obviously wrong, or reminds you of something from another field entirely that I have missed, I would like to hear it. Write to me at tc@purposeandmeans.io. I read everything, and the best material in this series has come from practitioners telling me where the argument breaks.

4 — Tag of the issue: #deceptive-design #

Each issue I pick one tag from the Purpose and Means blog and look into the thinking behind it. A way into my archive for new readers, and a reminder for everyone else that the work goes deeper than any single newsletter.

Dark patterns are the part of this that gets the attention. The cookie banner where “reject all” takes three clicks and “accept all” takes one. The unsubscribe link that opens a preference centre. The toggle that is already switched on. Just click accept is my piece on why that banner matters more than it appears to. Beyond Legal #26 comes at it from the other direction, through a UX researcher who did the obvious thing nobody does and asked people what they had actually understood.

Naming the patterns is the easy part. The harder question, and the one I have spent more time on, is what the opposite looks like. Deceptive design is a catalogue of what not to do. It does not tell a designer what to build instead, and a product team that has just been told its consent flow is manipulative still has to ship something by the end of the week.

For a number of years I have delivered education to a number of my clients about these ‘dangers’ and potential solutions. The first half is the deceptive patterns and how they are actually constructed, which is the part people expect. The second half is the privacy and data protection design patterns — documented, perfectly usable, and almost never reached for. The second half is the one that changes what gets built.

Explore all posts tagged #deceptive-design →

5 — Field Talk - November 2026 #

Under three weeks to go #

Field Talk runs 17 to 19 November. Free, practitioner-led, no sponsors and no sales pitches. You can register for a single session, a single day, or the whole thing. Two of the Wednesday afternoon sessions run back to back, and they make an interesting pair: one looks outward at how a data subject is conceived of, the other looks inward at the person doing the ‘protecting.’

Rogelio Aguilar-Alamilla is Head of DPO Services at BNP Paribas Group, with statutory DPO roles behind him across Europe, Asia and Latin America, and framework design work across the MEA, LATAM and APAC regions. His session, The Magnificent Data Subject, reads Pope Leo XIV’s first encyclical, Magnifica humanitas, published in May this year and concerned with safeguarding the human person in the age of artificial intelligence, from a data protection vantage point. Wednesday 18 November, 1700-1740 CET.

Paula Hoffler is co-founder and director of IDPAA Limited, an independent DPO and consultancy practice working across sectors in Ireland, with 28 years in risk and information management behind her. She is President of the Irish Computer Society and chairs the training committee of the Association of Data Protection Officers. Her session, Who Protects the Protector, is about the part of the job nobody puts in the job description: sitting between legal obligation, organisational pressure and interpersonal conflict, usually with no support of your own. She draws on mediation and risk management for practical strategies on handling difficult counterparties without burning yourself out. Wednesday 18 November, 1800-1840 CET.

See the full programme and register at fieldtalk.eu. Free to participate and free from vendor influence.

6 — What caught my eye #

Six things from the past two weeks worth your time.

Politicians have noticed that targeted advertising is an attack surface - Earlier this month Citizen Lab published what it calls the first technical demonstration of devices being infected in the wild through online advertising. The mechanism, which it names AdFection, works like this. An Israel-based company, Discover-Tech, bids in ordinary real-time auctions. When its ad is served, it receives the viewer’s advertising identifier and IP address. If that person is of interest, the device is sent malicious JavaScript that exploits the browser or app. The ads themselves carry no exploit code, which is exactly what keeps them invisible to the platforms serving them. Candiru spyware delivered this way was confirmed on devices at Al Jazeera. Impressions also landed on networks belonging to NATO, UN and EU bodies, defence firms, semiconductor companies and universities. An impression is not an infection, but it tells you who was in the auction. The political reaction arrived on 28 October: MEPs have signed a letter asking whether EU institutions are exposed, and two US senators have called for better security practice across the ad industry. This is the real-time bidding argument we have all been making for years, now with a working exploit chain attached. Every bid request is a broadcast. (The Citizen Lab, 28 October)

An SBOM tells you what is in the box, not where the box has been - At the ISC2 Security Congress last week, Atlassian’s Deepam Kanjani walked through a Shai-Hulud worm compromise in a large SaaS environment, identifying details altered but the mechanics real. The package passed every check it was meant to: matching SHA hash, more than 3,400 GitHub stars, a credible-looking repository. The malicious component was a transitive dependency buried three layers down, so a top-level audit never saw it. When a behavioural scanner flagged it, responders wrote the alert off as a false positive. The SBOM said the environment was clean. The SBOM was two development sprints out of date. With no runtime telemetry, the team hand-correlated logs across more than 400 services and still could not say with confidence what the compromise had reached. Attribution went nowhere: the repository had been copied from a real project and the publisher identity was fabricated. Kanjani’s summary is the line to keep: “You are triaging a runtime graph. Not a dependency file.” The data protection question after any supply chain compromise is whose personal data was reachable from the compromised thing, and it has to be answered inside 72 hours. An inventory will not answer it. (Dark Reading, 27 October)

Quad9 is leaving France - A French court ordered Quad9, the Swiss non-profit DNS resolver, to block domains accused of infringing a sports broadcaster’s copyrights. Quad9 says the order left it two bad options: apply French law to the entire world by blocking globally, or attempt to block only for users in France, which it cannot do reliably and which exposes it to heavy fines each time it fails. It has taken a third. It stops serving users in France on 24 November. Around twenty further French suits are pending. The accused material stays online throughout, because a resolver hosts nothing. What changes is that French users lose a privacy-respecting alternative to their ISP’s resolver, and a deliberately neutral piece of internet plumbing has been taught that neutrality is a liability. I use Quad9 across my own infrastructure, so I am not a disinterested party here. The principle stands without me: if a resolver can be compelled to block for copyright, it can be compelled to block for anything, and eventually someone will ask. (EFF, 27 October)

Datatilsynet has opened a formal investigation into the CPR lookups - The Danish DPA announced on 23 October that it is formally investigating how so many lookups in the CPR system were possible and what security measures were in place. Hearing letters have gone to the CPR administration and to Charity Guard ApS. The breach was notified on 4 October. What makes this one worth following is not that someone got in. It is that the access was, on its face, authorised. Volume was the attack. If your access controls are built around who may query a system rather than how much, how often and why, this is the case to read when the findings land. (Datatilsynet, 23 October)

The generation that was the product is now a market - The Guardian spoke to young people building their own way out of the attention economy. One solves maths problems before an app will reopen. One traded her smartphone for a Light Phone. One made her own app blocker from eight-dollar NFC tags. The digital detox industry around them is worth close to a billion dollars and is forecast to reach eight billion by 2035. Opal charges 99.99 dollars a year and has 10 million customers, three quarters of them gen Z, and roughly 95 per cent of them on the free tier. Kendall Schrohe of the Attention Studio puts the mood plainly: “Our generation were the guinea pigs to big tech.” Here is the question the piece does not ask. A tool that stops you opening an app has to know which apps you open, when, how often and for how long. That is a behavioural profile of considerable precision, generated by people who installed the thing precisely because they had concluded they were being profiled too much. The article makes no claim about how any of these companies handle that data, and neither do I. But a free tier serving nine and a half million people is a business model question, and it is the first one I would ask on the way to a DPIA. (The Guardian, 27 October)

The Council wants to give you more hours. Hours were never the problem. - On 21 October the Council agreed its negotiating position on the Digital Omnibus, publishing it the next day under the banner of simplification: obligations easier to understand and apply, administrative burden reduced, standards maintained. Among the changes it backs is a longer deadline for notifying personal data breaches, reported elsewhere as a move from 72 to 96 hours, alongside a single EU-level list of high-risk processing types and common compliance templates. Read that against two other items in this issue. The Shai-Hulud responders had an out-of-date SBOM, no runtime telemetry and more than 400 services to correlate by hand, and still could not say what the compromise had reached. In Denmark, Datatilsynet is now formally asking how so many CPR lookups were possible in the first place. Neither team was beaten by the clock. Both were beaten by not knowing what had been touched. An extra 24 hours buys one more day of the same uncertainty. If you want the notification deadline to stop hurting, the work is asset inventory, access logging and runtime visibility, and none of that is in the mandate, because none of it is something a legislature can hand you. None of it is law yet either. Parliament has not taken a position and the committee vote is not expected until early 2027. (Council of the EU, 22 October)

Hire me #

I work with companies and practitioners on a project basis — consultancy, training design, and workshop facilitation. No long-term lock-in. If you want to talk through a project, a DPIA process, or the deceptive design session described above, drop me a line or book time directly.

7 — Running it myself #

A new strand starting this issue. Each instalment covers one or two applications from my self-hosted setup — what they do, what they replace, and what it actually takes to run them.

Field Talk runs in three weeks. It is entirely self-hosted: the live stream, the video archive, the conference site, the speaker registration, the calendar bookings, the email to participants — none of it runs on a platform I do not control. That is not a boast. It is the point.

In the EU there is increasing focus on recommending EU-sovereign, open-source alternatives to the US platforms that most companies default to. I think that advice is right. I also think it is easier to give than to follow, and I became uncomfortable with the gap between what I recommend to clients and what I was actually running myself.

So I closed it. Over the past couple of years I have built a home lab — a small collection of machines in my house in Copenhagen and a server at Hetzner in Germany — and migrated almost everything I use onto it. The process has been educational in a way that no amount of reading about it could have been. There is a considerable difference between understanding in principle that self-hosting requires maintenance and actually doing that maintenance at half past ten on a Tuesday evening because something has stopped working.

This strand is for anyone who is curious about doing the same, or who simply wants to understand what it involves before deciding whether it is worth it. I am not going to tell you it is easy, because it is not. I am going to tell you what I have replaced, what it has cost in time and in licences I no longer pay, and what I have learned by doing it rather than recommending it.

The applications start next issue. This one is just the introduction.

← All issues / Subscribe