Data Protection by Design

13 May 2026 · 7 min read

Beyond Legal #38: The data protection leader who understood system design - and changed everything

An Enterprise Architect and a Data Protection Leader embedded data protection into the company's architecture itself. Both were elevated to board level.

6 May 2026 · 6 min read

Beyond Legal #33: The product manager who said the Supervisory Authority could wait

A product manager launched a feature without a DPIA or data protection by design. The supervisory authority did not wait.

3 May 2026 · 6 min read

Beyond Legal #32: The internal comms manager who made compliance something people actually read

An internal comms manager translated data protection obligations into language employees actually read. The training programme changed completely.

27 Apr 2026 · 5 min read

Beyond Legal #26: The UX researcher who asked what users actually understood

A UX researcher asked whether users actually understand what they consent to. The answer reshaped the entire data protection programme.

24 Apr 2026 · 7 min read

Beyond Legal #25: The CISO who thought data protection was a subset of security

Placing data protection inside the security team feels logical but misses what GDPR actually requires. What the security-centric worldview gets wrong.