Latest 18 articles, page 1 of 2
Opt-in means ask first; opt-out means stop on request. When GDPR requires each, with a comparison table and examples for email, cookies, calls and data sharing.
Art. 35(3)(b) names large-scale Art. 9 processing, so a health DPIA is rarely optional. The Art. 35(7) content applied to a clinical system, WP248 criteria, Art. 36 prior consultation, and when to redo it.
Canada's adequacy decision does not exempt Canadian companies from the GDPR. When Art. 3(2) applies, the Art. 27 EU representative duty, and what health data changes.
Health data needs an Art. 9(2) condition on top of an Art. 6 lawful basis. Controller mapping across providers, insurers and vendors, why consent fails in care, Art. 9(4) national law.
Most Indian companies meet the GDPR as processors for European clients, not through Art. 3(2) targeting. What Arts. 28, 30(2), 32 and 33(2) require, and why health data is audited hardest.
The MDR Art. 11 Authorised Representative does not satisfy GDPR Art. 27. Two separate appointments, plus controller/processor status for telemetry, post-market surveillance versus minimisation, and SaMD.
Which Art. 9(2) conditions health organisations actually rely on and how each one fails: explicit consent, 9(2)(h) with the Art. 9(3) secrecy trap, public health, and research under Art. 89(1).
Art. 4(7) GDPR defines the data controller as the entity that determines processing purposes and means. Understand your obligations, liability and examples.
A practical review of privacy-workflow scope, evidence, implementation and procurement questions.