GDPR at 10

27 Apr 2026 · 5 min read

Beyond Legal #26: The UX researcher who asked what users actually understood

A UX researcher asked whether users actually understand what they consent to. The answer reshaped the entire data protection programme.

24 Apr 2026 · 7 min read

Beyond Legal #25: The CISO who thought data protection was a subset of security

Placing data protection inside the security team feels logical but misses what GDPR actually requires. What the security-centric worldview gets wrong.

23 Apr 2026 · 6 min read

Beyond Legal #24: The procurement manager who finally met his match

Most procurement teams review data processing agreements without understanding them. How one Data Protection Leader transformed third-party risk management.

22 Apr 2026 · 3 min read

Beyond Legal #23: The HR business partner who sent the survey anyway

An HR business partner sent an employee survey without a GDPR lawful basis. The consequences were not abstract. Why Article 6 applies to internal processing too.

21 Apr 2026 · 5 min read

Beyond Legal #22: The data architect who made the invisible visible

A data architect showed a Data Protection Leader how personal data actually moves through a business. What followed changed the entire programme — and both their careers.

20 Apr 2026 · 4 min read

Beyond Legal #21: The engineer who built exactly what he was asked

A software engineer built exactly what the ticket said. The Data Protection Leader signed it off without checking. One kept their job. One didn't.