Blog

GDPR and privacy

What the GDPR asks of a small team, whether you are based in the EU or sell to people who are: the website, the contracts, the tools, people's rights and the deadlines.

Start here The article title in white on a ribbed-glass panel over a photo of a cookie consent banner with Refuse all and Accept all buttons of the same size Complete guide16 min read GDPR for small-team businesses: the complete guide, inside and outside the EU GDPR for small business, step by step: does it apply outside the EU, data map, cookie banner, contracts, people's rights, breaches, fines and 2026 changes.
The article title in white on a ribbed-glass panel over a photo of connected boxes in a flow diagram News8 min read The EU’s Digital Omnibus: what could change for GDPR and cookies Digital Omnibus GDPR changes explained: personal data, one-click cookie refusal, AI, 96-hour breach reports, and where the EU proposal stands in October 2026. The article’s title in white on a ribbed-glass panel over a photo of a blueprint grid with a target News8 min read UK GDPR after the Data (Use and Access) Act 2025: what changed The Data (Use and Access) Act 2025’s UK GDPR and PECR changes now apply: cookie exemptions, access requests, a complaints duty, higher fines. What to update. The title “GDPR fines: what a small-team business really risks (real cases)” in white on a ribbed-glass panel over a photo, with a rising line chart Guide9 min read GDPR fines: what a small-team business really risks (real cases) GDPR fines for small businesses: what the CNIL and the ICO really impose, real cases (€3,000, €20,000, £92,000), what starts a case and how to cut your risk. The title “Data breach: what to do in the first 72 hours” in white on a ribbed-glass panel over a photo, with a shield bearing a check mark Guide11 min read Data breach: what to do in the first 72 hours GDPR data breach notification, step by step: when the 72-hour clock starts, how to report to the ICO or the CNIL, when to tell customers and what to record. The title “Subject access requests: how to answer within one month” in white on a ribbed-glass panel over a photo, with stacked envelopes and a notification badge Guide9 min read Subject access requests: how to answer within one month How to answer a subject access request within one month: what to send, ID checks, searches, redaction, extensions and a reply template, for the UK and EU. The article's title in white on a ribbed-glass panel over a photo of a calendar grid with booked slots Guide9 min read How long can you keep client and prospect data? GDPR retention periods for your CRM GDPR data retention periods for clients and prospects: what the CNIL and the ICO expect, a schedule to copy, and how to make your CRM delete on time. The article’s title in white on a ribbed-glass panel over a photo of a blueprint grid with a target Guide9 min read Data processing agreements (Article 28): when you need one with clients and suppliers A data processing agreement is required whenever a supplier handles personal data for you. When you need one, what Article 28 requires, and free templates. The article’s title in white on a ribbed-glass panel over a photo of connected boxes in a flow diagram Guide10 min read Using US tools under GDPR: Google, Microsoft, Mailchimp and the Data Privacy Framework EU-US Data Privacy Framework explained: when you can use Google, Microsoft or Mailchimp under GDPR, how to check a US tool and what to do if it isn’t listed. The article’s title in white on a ribbed-glass panel over a photo of a browser window with a page layout Guide9 min read Website legal notice: what you must publish in France, the EU and the UK Website legal notice requirements for France, the EU and the UK: what to publish for a company or a sole trader, the penalties, and a template to copy. The article’s title in white on a ribbed-glass panel over a photo of a browser window with a page layout Guide10 min read Privacy policy: what yours must say, section by section What to include in a privacy policy under GDPR and UK GDPR: every section Articles 13 and 14 require, sample wording, and the mistakes copied templates make. The article title in white on a ribbed-glass panel over a photo of a cookie consent banner with Refuse all and Accept all buttons of the same size Tutorial11 min read Set up a compliant cookie banner on Squarespace, Wix or WordPress (with Consent Mode v2) How to add a cookie banner to a website on Squarespace, Wix or WordPress: block trackers until consent, set up Consent Mode v2 and test it in DevTools. The article title in white on a ribbed-glass panel over a photo of a cookie consent banner with Accept and Refuse buttons Guide12 min read Cookie banners in 2026: what the EU, the UK and France’s CNIL really require Cookie banner requirements in 2026: which cookies need consent, the CNIL's 'Refuse all' test, the UK's new analytics exception and what regulators fine. The article’s title in white on a ribbed-glass panel over a photo of a blueprint grid with a target Guide10 min read EU representative under GDPR (Article 27): who needs one and how to appoint one Most companies outside the EU that sell to or track people in the EU need a GDPR EU representative. Who needs one, the exemption and how to appoint one. The article’s title in white on a ribbed-glass panel over a photo of small dots orbiting a bright star Guide12 min read Does GDPR apply to your company if it’s outside the EU? The two tests, with examples Does GDPR apply to non-EU companies? Yes, if you have an EU establishment, sell to people in the EU or track them there. The two tests, with six examples.

Most of the GDPR comes down to a handful of habits: say what you collect and why, ask before tracking, sign the right contracts, answer requests on time and react fast when something leaks. These guides explain each rule in plain words, with the article of the law and the regulator’s own guidance, for EU businesses and for companies in the UK, Switzerland, North America or elsewhere that have users or buyers in the EU.

Let’s build what comes next.

A website, a ranking or a full calendar: tell us where you want to be, and we reply within forty-eight hours with a clear plan.

Discuss your project
Contact Start a project
Write to us