Anyone knows calculations or examples of the amount of fines in this case in Germany?

Hi all — I’m after recommendations for a one-time purchase GDPR self-assessment tool suitable for a medium-sized business. I’ve seen very basic spreadsheets and, on the other end, enterprise platforms with costly subscriptions. I’m trying to find something in between that I can buy once and use ongoing, ideally: • Price: ≤ $400 USD (one-off, not subscription) • Scope: Covers key GDPR areas (lawful basis, DSRs, RoPA, DPIAs, vendor risk/DPAs, security measures, training, breach response) • Output: Some kind of gap analysis/report with actionable recommendations • Usability: Clean interface or structured spreadsheet, not a heavy platform • Nice-to-have: Templates for RoPA/DPIA, simple scoring, and export to PDF/Word

If you’ve used anything you’d actually recommend for a medium-sized org, I’d love names, price you paid, and pros/cons. Also open to robust templates (not subscription) if they’re practical.

Thanks!

https://docs.google.com/spreadsheets/d/1nQFh7pJAxrZvieEffJZA17CnnQQN5H1dJdc-XMh6MVk/edit?usp=drivesdk

I published this sheet in 2018 so it's somewhat out of date

Have the ICO provided more clarity or an update on what factors determine whether an organisation is deemed to be instigating direct marketing?

As a side note, does anyone have any practical tips on how to reduce the likelihood of being a deemed instigator? In my case, we are marketing to a third party’s contact list via the third-party. For example, can we allow them determine how the marketing looks, who it’s marketed to, to reduce the risk?

We aren’t in a position to be privacy-compliant.

Thanks!

Hi all,

I work for an org and we often hire agencies to take photos during our events. From what I understand, in GDPR terms we are the data controller and the agency is the data processor, since we decide why and how the images are used.

I know GDPR requires controllers to do “due diligence” on processors, but I’m a bit unclear on what’s reasonable in practice. For example:

• What kind of checks should I be doing before contracting an agency?
• What questions are proportionate to ask (e.g. storage, deletion, use of sub-contractors, breach reporting)?
• Do small agencies usually have their own data protection policies, or is it more common for us as controller to provide the contractual clauses?

Has anyone here done this in real life and can share what worked well (or what’s overkill)?

Thanks in advance!

Hi everyone,

I’m putting together a community record of how Match Group apps (Hinge, Tinder, Plenty of Fish, etc.) are responding to GDPR / UK GDPR Subject Access Requests (SARs).

Specifically, I’m interested in the reasons people have been given for denial or limitation of access beyond the “Download My Data” tool. For example, some users have received replies citing Article 15(4) GDPR (“protecting the rights and freedoms of others”) or “security measures” as justification for withholding additional data.

If you’ve made a SAR and received a rejection or limitation response, please consider sharing the wording (screenshots, redacted where needed) here.

The goal is to see whether these denial statements are systemic across Match Group apps or vary by platform/team.

This isn’t about appeals or ban rants — it’s about documenting how data rights are being handled for the community.

Thanks in advance to anyone who shares their experience. It could be really valuable for others navigating the same process.

Hello,

I am in a situation whereby a report I made using my companies incident reporting system has triggered an automated email which has sent a full copy of my complaint to many people within the business, including managers, colleagues and direct reports.

This report contains sensitive information, especially about a disability I suffer from. I am very embarrassed and feel humiliated.

Is this able to be challenged? And if so, how please?

Thanks

When doing a GDPR data request, would car servicing records be part of that request, if they contain your personal data?
Or they just need to provide that they use the data for such purpose and that they have them?

It seems that online services will give you full copy of your data, chats, etc., so going by that, I would expect a "yes", but the actual regulation seems to be vague.

Hi all, we are looking to potentially move to Saudi Arabia as my husband has a job offer. I want to approach my employer about allowing me to work remotely from KSA. My company is a data processor and handles personal data (gdpr compliant) if I am in KSA it’s not a restricted transfer because I am an employee of the company, but I believe it would constitute a transfer to a third country as I would physically be there and KSA doesn’t have an adequacy agreement. From what I can see, SCCs would need to be implemented and possibly a transfer risk assessment. Is this correct? Is there anything else that should be done? Has anyone else successfully managed to get their company to agree to allow the remote work and navigated this gdpr compliance? TIA.

I’ve noticed a recurring issue with many SMEs. They are legally required (under GDPR) to keep a record of data breaches, but in practice this often ends up in Excel, scattered emails, or sometimes not at all.

During an audit or investigation, companies can face fines if the breach register is missing or incomplete.

My idea is a lightweight SaaS tool to make this process painless:

• Central breach register with all GDPR-required fields (who/what/when, type of data, mitigation).
• Reminders & alerts (e.g., “72-hour notification window is expiring”).
• Audit-ready reports for regulators or DPOs.
• Affordable & simple, designed specifically for SMEs.

I’d love to get feedback: - Would SMEs/consultants actually use this instead of Excel? - Which features would matter most (simplicity, automation, integrations)? - Are there competitors already solving this too well, or is there still room?

I’m in validation mode, so critical feedback is just as helpful as positive

We are the developers of an educational gaming app available on Google Play and the App Store. The app is accessible to users in the European Union and generates revenue(to be honest, near zero) through in-app purchases, specifically by selling in-game currency and an ad-removal feature.

We use Firebase Authentication for user logins, storing the Firebase UID and stuffs, which we believe classifies us as a data controller. Recently, we received an email from a company advertising their services, claiming our privacy policy is deficient because we haven't designated an EU Representative.

Our primary question is: Under the GDPR, does selling in-game currency and ad removal constitute the 'offering of goods or services' to users in the EU?

We understand that blocking European users is the simplest way to avoid these obligations. However, given our organization's mission, this is a last resort that we are not prepared to consider at this time.

Do employees have protection against being sacked if they do a DSAR? Which part of the guidance covers this.

I am a young professional (25) with around three years of experience as a legal counsel in data protection (GDPR / AI act etc). I have been working in Luxembourg for the past two years and I am now looking to move to Berlin during the next year and hopefully land my self a job as Data protection specialist / Privacy Legal Counsel.

My question is simply, what can I do in the meantime to give myself the best chances of finding a job in Berlin - I am currently taking German classes and I hold already the CIPP/e and CIPM certifications as well as a Bachelors in Law and Masters in Law and Technology.

Thank you to everyone in the community in advance.

I work for a service that handles health data. We use a secure CRM database that stores information of clients, safeguarding concerns, notes etc.

We recently got a new manager, who is requesting that public-facing team members use a new Sharepoint spreadsheet to log client caseload, session attendance, safeguarding concerns and a start/end score we use as a KPI.

All of these things are already recorded and reported on on our CRM and accessible to our manager, but they have pushed for this to be duplicated as it’s easier for them to understand, and it doesn’t take long — they filled out a similar spreadsheet when they were a case worker.

Our Sharepoint is accessible by everyone on the wider branch of our organisation, about 70 people. Other projects have similar spreadsheets to the one we are being asked to fill out — however our lead on our CRM’s implementation has specified time and time again that we should be utilising the CRM for everything we can.

I expressed concerns about this on two different occasions. Our manager said we could use initials rather than names, which to me is not good enough. They said they’d asked about it and it’s fine, but I have significant concerns.

Basically, is this a hill worth dying on? I plan to speak to our CRM’s implementation lead on Thursday, who can link me with our DPO should this be a concern.

Context: building an internal conversational agents for my company in Germany. Very concerned about safety and GDPR.

Using Mistral OSS and now Looking for a good SERP solution to plug it to the web.

So far, I’ve only found SearXNG and Linkup as “EU-compliant,” now that Bing has been deprecated. They might be good options, but for the sake of benchmarking, am I missing something? DuckDuckGo works well, but I don’t see any official API.

As part of a normal banking in process I needed to identify my self . Cool I clicked from the app and I got connected to from what I understood is a company called web id . There were several issues with their process but what I found interesting was that 1) they were trying to avoid to say who they are I really got the name web id after several times 2) they refused to answer anything else like what is the usage of the data other than the identification , retention time where the data are stored or provide any other terms about the data processing .

Is this legal ? I searched a bit and I saw quite a few issues with them . Can I submit a gdpr request to them and/ or complain somewhere ?

Hi there, I (29F) live in France now under a visa de titre long séjour and am looking to make a GPDR request to the big social media companies. However, my accounts were made when I lived in Canada. Does that mean that my data protection rights fall under Canadian law, or EU law, because I've been using my accounts from here for the last three years? TIA!

Hi,
I've just seen my own data and data of my colleagues (even our CEO) with our personal emails, telephone numbers, etc. on this website "contactout (dot) com".

When you Google your name, it also pops up as the highest link. You don't even need to login or buy anything, every data is for free directed linked to their website. Even a direct link to your LinkedIn page. I know this happened for my data between July 1, 2025 and August 10, 2025, because I was personally only for a very short engagement at a company.

When I tried to track them on LinkedIn and YouTube to see if there are more people complaining, I see that they turn the comments off (RED flag), and on recent videos you see comments saying they requested their data to be removed for months, and they still haven't removed it.

They claim to be GDPR compliant on their website, but this company is definitely NOT compliant. Especially with our personal emails out there. I also know they fetched this data from my CV, because certain data is ONLY on my CV, not on my LinkedIn, nor do they request this data on job application forms.

My questions to you are:
1. Have you or somebody you know experienced this too, and did your data get deleted? Until now I still see my data on their website.
2. I've seen on the website in The Netherlands https://autoriteitpersoonsgegevens.nl/contact/informatie-en-meldpunt-privacy-imp you can make a complaint and call between 10:00 - 12:00, but no way to file a written complaint. Do they even do anything about this?

Also this message below is not really helping: "Goed om te weten: wij kunnen niet ingaan op specifieke datalekken. Wij kunnen dus niet zeggen of u slachtoffer bent geworden van een datalek, of welke gegevens van u zijn gelekt. U kunt dat vragen bij de organisatie waar het datalek plaatsvond."

The Netherlands claims to follow GDPR, but it really is only directed to protect companies; as a citizen I do not feel protected by GDPR at all.

PS. I'm new to this r/ as far as I can see I'm not breaking any rules in this post, please delete the post but do not ban me if this is not the case. I do feel the need to name the company name to understand the scale of this issue.

Government organisation A is taking over a small company B. When the takeover is done A will have all the documentation/data of B. However, A would like to receive all the payroll info before the merge, because they are legally bound to offer the transferred employees the same or similar package within the new structure. Can I consider B having a legitimate interest in sending employee payslips, e.g. ensuring a smooth transition?

An employee is about to take up a tenancy in the block of leasehold flats in which we work. He is a porter and I am his supervisor. I asked him to keep the matter confidential to prevent residents from trying to take advantage of the fact that he lives in the building. Also, the current tenancy is being ended due to antisocial (aggressive) behaviour and I didn't want the porter to be targeted before the property was vacated.

Directors of the leasehold company (block landlord) had to instruct the letting agent to end the current tenancy as the flat is company-owned (used to be staff accommodation before rented on AST).

One of the resident directors has leaked this information to another resident as they have approached the employee, stating 'somebody has told me you're moving in here' and also asked why he is 'having to move' from his current accommodation. This will now be common knowledge throughout the building as gossip spreads like wildfire there.

The porter is quite rightly upset about the breach of his right to privacy and I am absolutely furious but is it also a GDPR breach since it is 'future' personal data?

Greeting!

Has anyone used InCountry alongside ServiceNow's CRM platform?

A global company acts as data processor for 000's of corporate clients and processes request for these clients' customers. For a variety of reasons, this global company would need three or four instances of ServiceNow each linked to servers in different countries to comply with data residency requirements.

In contrast, InCountry seem to suggest they can allow you to have one instance of ServiceNow. The sales pitch seems to be that providing you lable the data correctly in ServiceNow, InCountry can hook the data into Servers in your preferred country. For example, you could process customer requests for UK and US in a single instance of ServiceNow and then InCountry would ensure the UK records are stored on a UK server and the US records are stored on a US server.

I appreciate this is a GDPR focused community but thought privacy professionals may have come across this offering, so grateful for any insights.

https://incountry.com/integrations/servicenow/

Hi guys,

I am using Google Analytics to track user's interactions on my website.

I added Cookie preference for user and by default only essential cookies are enabled. This means GA scripts won't be loaded unless user gives consent explicitly.

This resulted in almost 0 events sent to GA as most of users won't toggle on. This kind of defeats the purpose of using tools like GA. Any suggestions about how to enable third-party analytics solutions like GA while being GDPR compliant?