Resources

GDPR explained,
simply.

Plain-language guides for European business owners — no legal degree required. Cookie compliance, breach notification, AI governance, and what's actually changing in GDPR enforcement.

✦ Explore the tools Browse articles →

22 articles

Everything we've written
on GDPR and the AI Act.

Plain-language guides for European business owners — no legal degree required. Newest first.

AI & GDPR Guidance

“It Was Public Anyway” Is Not a Legal Basis: The New Rules for Scraping the Web to Train AI

The EDPB's draft web scraping guidelines and the UK ICO's new report explain what you must prove on legal basis, transparency, sensitive data and safeguards before training AI on public data.

11 min read →

We Built Seven Free GDPR Skills and Ran Them on Our Own Site

Free, open-source GDPR skills for DPIAs, records of processing, policy reviews, breach response and more. What they found on our own site, where they were wrong, and how to install them.

Your AI Runs on Personal Data: What the GDPR Expects in 2026

Legal bases for AI training, Article 22, data subject rights, DPIAs, the AI Act timeline and an 11-point checklist for companies using or building AI.

10 min read →

GDPR Enforcement

Google's €403M Fine: Your App's Location Data Is Next

Ireland's regulator fined Google €403M over three location features: unclear legal basis, thin transparency and data kept too long. What it means for the apps, trackers and devices in your own business.

EU AI Act & GDPR

The AI Act Was Delayed, Not Cancelled: Your 2026 to 2028 Compliance Calendar

High-risk AI rules now start in December 2027, but transparency duties apply today. A dated calendar for 2026 to 2028 and how the AI Act fits with the GDPR.

The GDPR Is Being Rewritten for AI: What the Digital Omnibus Means for Your Business

The Commission wants AI training to count as a legitimate interest and personal data to mean less. What is proposed, what the leaked Council text adds, and what to do now.

EU AI Act & GDPR

AI Act Article 50: What the Final Guidelines Mean for Your Chatbot and AI Content

The Commission's final guidelines on AI Act Article 50 explain how to disclose chatbots, label deepfakes and handle AI-written text. What applies since 2 August, what is deferred, and where the GDPR adds its own test.

AI & GDPR Guidance

Is Your “Anonymous” Data Really Anonymous? The EDPB's New Draft Changes the Test

The EDPB's draft guidelines make “anonymous” depend on who holds the data and ask for re-checks as AI gets better at re-identification. What they say, what they leave open, and what to do before the 30 October deadline.

AI & GDPR Enforcement

Uber's €825M Fine: When “The Algorithm Decided” Becomes a Liability

The Dutch regulator fined Uber €825M for letting software deactivate drivers with no human review. What Article 22 requires, and how to check the AI and scoring tools in your own business.

GDPR Enforcement & Reform

The EDPB just standardised how every DPA in Europe calculates your fine

A new five-step test now governs every GDPR fine calculation across the EU — and lands the same week Ireland's DPC fined Google €403 million. What the harmonised methodology means for SMBs.

GDPR Reform & Enforcement

GDPR in 2026: why “simplification” doesn't mean you can relax

The AI Act delay is law, but the GDPR cookie, breach and AI changes are still only proposals — and enforcement keeps rising. What to fix now and what to wait on.

GDPR & AI Governance

GDPR and AI governance in 2026: one half of the reform is already law. The other half is stuck.

The AI Act half of the Digital Omnibus is done — high-risk deadlines moved to December 2027. The GDPR half is still stalled. Here's what European SMBs should actually do about each.

AI Governance & GDPR

GDPR in the AI era: what 2026 is teaching compliance teams

Cumulative GDPR fines have passed €7 billion and the Digital Omnibus could make "legitimate interest" a legal basis for AI training. Here's what 2026 is actually teaching compliance teams.

Data Security & GDPR Tools

Is a VPN Mandatory Under the GDPR?

The GDPR never names a VPN as required — Article 32 asks for risk-based security instead. What that actually means for EU businesses.

Data Security & GDPR Tools

How a VPN Strengthens GDPR Compliance in 2026

IP protection, Article 32 encryption, and secure remote access — a practical guide to where a VPN fits into your GDPR compliance stack.

AI Tools & GDPR

Your AI chatbot isn't anonymising anything

The EDPB says AI models are rarely anonymous — so the chatbot, CRM assistant and note-taker you already run need a DPIA, a legal basis and a disclosure of their own.

Industry Benchmark

GDPR Compliance Benchmark 2026: Readiness Scores by Industry

A composite GDPR readiness score for six industries, built from Verizon's 2026 breach data and CMS's 2026 GDPR fine tracker — full methodology and sources.

10 min read →

AI & GDPR Compliance

AI Is 2026's Biggest GDPR Compliance Risk

Legitimate interest assessments, mandatory DPIAs for biometric AI, and Ireland's Grok inquiry show why AI has become GDPR's single largest source of risk in 2026.

AI Training Data & GDPR

The "It Was Public" Excuse Is Over: GDPR Now Formally Covers AI Training Data

The EDPB's new guidelines end the assumption that scraped public data is fair game for AI training — with no grace period for datasets collected years ago.

AI & GDPR Enforcement

Forget the AI Act — GDPR is already fining companies for AI mistakes

Three recent cases — Clearview AI (€30.5M), a German fintech (€492K), and Replika (€5M) — show regulators using GDPR, not the AI Act, to punish exactly the kind of AI mistakes any business could make.

EU-US Data Transfers

Is “Schrems III” coming? A Supreme Court ruling shakes the Data Privacy Framework

A June 2026 ruling stripped FTC commissioners of removal protections — a pillar the EU cited 259 times to justify the EU-US Data Privacy Framework. Here's what's actually at risk.

Digital Omnibus & GDPR Reform

Inside the EU's Digital Omnibus: what's actually changing for GDPR, and what just stalled

The Digital Omnibus would raise the RoPA exemption to 750 employees, add a one-click cookie reject button, and clarify AI legitimate interest. Only one of those three survived June's Council talks.

GDPR Enforcement & Reform

GDPR in 2026: record fines, a reform in motion, and what to do now

GDPR fines have passed €7.1 billion and the EU's Digital Omnibus is rewriting cookie consent, breach notification, and DPIA rules. Here's what's actually changed, and what's still just a proposal.

EU AI Act & GDPR

The high-risk deadline moved to December 2027. The GDPR overlap didn't move at all.

The AI Omnibus bought Annex III systems 16 extra months. It bought nothing for GDPR, the penalty tiers, or the two new prohibitions landing in December 2026. Where the two laws still collide.

Updated September 2026

AI & Business Strategy

AI news and insights: what's actually driving AI-driven business growth

AI spending will hit $2.59 trillion in 2026 — but only 5% of companies say their data is ready for it. What the latest numbers mean for your business.

Why every SaaS company needs a DPIA before launching AI features

AI features change how a SaaS product collects, interprets and acts on personal data. A Data Protection Impact Assessment catches overcollection, permission leaks and output risk while they're still cheap to fix.

The AI Act delay doesn't cover your chatbot

The AI Act's high-risk rules were delayed to December 2027 — but Article 50's chatbot and AI-content transparency rules were not. Here's what still applies from August 2, 2026.

Common Mistakes

The 10 biggest GDPR mistakes small businesses make

From over-collecting data to skipping a privacy policy entirely — the 10 most common (and costly) GDPR mistakes we see European SMBs make, and the practical steps to fix each one.

Small Business Guide

Is my small business required to comply with GDPR?

"We're too small for GDPR" is one of the most common — and costly — misconceptions among European SMBs. Here's who actually needs to comply, and what it requires.

11 min read →

Cookie Compliance

The 5 most common cookie banner mistakes — and how to fix them

78% of European SMB websites have illegal cookie banners. Most violations are simple to fix. We break down the Planet49 ECJ ruling and what it means for your website today.

What is GDPR and does it apply to your small business?

GDPR applies to every business that processes data of EU residents — regardless of size or location. Here's what that means in practice, and the 5 things you need to do first.

No articles match your search Try a different keyword, or clear the search.

Page 1 of 4

More guides coming soon · Get in touch →

Privacy isn't a checkbox — it's a habit worth building, one honest step at a time. That's what GDPRGard is here to help with.

🍪 Cookie & Privacy Settings

We use a small set of cookies and outside service providers (processors) to run this site, offer our AI tools, and — only if you allow it — show ads. Nothing non-essential loads until you choose.

▸NecessaryAlways active

Keeps the site working: remembers this consent choice and keeps multi-step tool forms working as you move between steps.

▸Service ProcessorsAlways active

Formspree processes form submissions (contact, reviews, sign-ups). Netlify hosts the site and runs its serverless functions. Neither sets tracking cookies.

▸AI AssistantAlways active

Anthropic (Claude) powers GDPRChat and the GDPR Audit tool. Your input is sent to Anthropic’s API only when you actively use one of these tools, and is not stored by us.

▸MarketingOptional

Google AdSense sets third-party advertising cookies to show and measure ads. Off by default — nothing from Google’s ad network loads until you allow this category.

Every cookie and outside processor used on this site, in plain terms:

Name / provider	Category	Purpose	Duration
gdprgard_cookie_consent_v2 GDPRGard.eu	Necessary	Remembers your accept/reject cookie choice	365 days
Session state GDPRGard.eu	Necessary	Keeps multi-step tool forms working as you move between steps	Browser session
Form submissions Formspree, Inc. (US)	Service Processors	Processes contact-form, review, and sign-up submissions	No browser cookie
Hosting & functions Netlify, Inc. (US)	Service Processors	Hosts the site and runs its serverless functions	No browser cookie
API requests Anthropic PBC (US)	AI Assistant	Powers GDPRChat and the GDPR Audit tool when you actively use them	No browser cookie
IDE, __gads, __gpi Google Ireland Ltd / Google LLC	Marketing	Ad personalization & measurement	Up to 13 months
test_cookie, NID Google Ireland Ltd / Google LLC	Marketing	Ad delivery & frequency capping	Up to 6 months

GDPRGard.eu (Zirlandia Milkovic, freelance GDPR consultancy, Rijeka, Croatia) is the data controller for this site. We disclose every third-party processor and tracker we actually use — nothing is hidden behind vague language like “we use cookies to improve your experience.” You can change your choice at any time from the 🍪 icon in the corner, or from the Cookie Policy page. Questions: privacy@gdprgard.eu.

See our Cookie Policy and Privacy Policy.

This site only sets necessary cookies required for it to function — Google AdSense advertising cookies load only with JavaScript-based consent. See our Cookie Policy and Privacy Policy.