Records of Processing

13 May 2026 · 7 min read

Beyond Legal #38: The data protection leader who understood system design - and changed everything

An Enterprise Architect and a Data Protection Leader embedded data protection into the company's architecture itself. Both were elevated to board level.

8 May 2026 · 9 min read

Beyond Legal #35: The supply chain manager who thought sub-processors were someone else's problem

A supply chain manager handed off logistics without asking what data sub-processors were processing. The chain grew until nobody could map it.

29 Apr 2026 · 6 min read

Beyond Legal #28: The business analyst who mapped what no one else could see

A business analyst mapped processing activities in forensic detail. What she found changed everything the Data Protection Leader thought she knew.

22 Apr 2026 · 3 min read

Beyond Legal #23: The HR business partner who sent the survey anyway

An HR business partner sent an employee survey without a GDPR lawful basis. The consequences were not abstract. Why Article 6 applies to internal processing too.

21 Apr 2026 · 5 min read

Beyond Legal #22: The data architect who made the invisible visible

A data architect showed a Data Protection Leader how personal data actually moves through a business. What followed changed the entire programme — and both their careers.

20 Apr 2026 · 4 min read

Beyond Legal #21: The engineer who built exactly what he was asked

A software engineer built exactly what the ticket said. The Data Protection Leader signed it off without checking. One kept their job. One didn't.

8 Dec 2025 · 6 min read

Beyond Legal #14: Does your RoPA really show how your company processes personal data? (Why you need business analysis skills)

Your Record of Processing Activities (RoPA) is a solid foundation. Now, let’s bring it to life by swapping legal questions for operational essentials.

23 Sep 2025 · 12 min read

Beyond legal #9: Get to know your SDLC

How to integrate data protection into your SDLC so your team influences software design from day one — not reviewing privacy notices after deployment.

12 Sep 2025 · 14 min read

Beyond legal #7: You can't protect what you are not aware of

A Record of Processing Activities (RoPA) under GDPR Article 30 should be your data protection nerve centre — not a forgotten spreadsheet. How to build one that works.

15 Mar 2017 · 6 min read

GDPR data flow mapping - an approach

Data flow mapping is essential for GDPR Article 30 compliance. A pragmatic, visual approach to mapping where personal data is collected, stored, used, transferred, and disposed of across legal entities.

8 Mar 2016 · 3 min read

GDPR: which tool to use for mapping data flows

Written in March 2016, this article asks which tools organisations should use to map personal data flows for GDPR — from Visio and Excel to Microsoft's free Threat Modelling Tool.