The GDPR emphasizes specific data subject rights. While ‘reasonable’ is used in some contexts, for the right to erasure, regulators expect clarity. A defined period (e.g., 30 days) is considered best practice to demonstrate compliance and avoid regulatory scrutiny for being overly vague.

Modern privacy regulations like the GDPR and many others require consent to be freely given, specific, informed, and an unambiguous indication of the individual’s wishes. A pre-checked box does not constitute an affirmative action; the user must actively opt-in. Relying on pre-checked consent is a common compliance failure.

The Storage Limitation principle (or Data Retention principle) states that personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Indefinite storage without a justified purpose and a defined retention schedule is a clear violation of this principle.

The GDPR has specific protections for children’s personal data. For information society services offered directly to a child, consent must be given or authorized by the holder of parental responsibility, where the child is below the age of digital consent (set by each EU member state, between 13 and 16). This is a strict legal requirement, not just a best practice.

When a compliance gap involving a third-party processor is discovered, the controller (your company) has an obligation to stop the potential violation promptly. Disabling the script prevents further unauthorized collection. This must be followed by an assessment to understand the scope, update disclosures, and review the Data Processing Agreement (DPA) to ensure the vendor’s obligations are clear and being met.

A core tenet of privacy-by-design is that processing must be necessary for a legitimate purpose and proportional to that purpose. A DPIA must scrutinize whether the same goal could be achieved with less data, less intrusive data, or different processing methods. This directly links to the Data Minimization and Purpose Limitation principles.

The right of access entitles the individual to a copy of their personal data. It must be provided in a secure and accessible format. However, you have an obligation to protect the rights of others, so redacting third-party personal data (e.g., other employees’ names in emails) is necessary and standard practice. You cannot refuse the request simply because it is broad.

Relying on Legitimate Interests requires a three-part test: 1) Identify the legitimate interest, 2) Demonstrate the processing is necessary to achieve it, and 3) Balance it against the individual’s interests, rights, and freedoms. This balancing test and the safeguards (e.g., human review of automated decisions, clear appeal process) are the core of the LIA documentation required to justify this legal basis.

Consent cannot be inferred or assumed, especially during a transfer. If valid consent records do not exist or cannot be verified, the legal basis for marketing is absent. The compliant path is to treat these individuals as new contacts and obtain fresh, unambiguous opt-in consent that meets current standards. Starting to email them without consent would constitute a violation.

The GDPR emphasizes specific data subject rights. While ‘reasonable’ is used in some contexts, for the right to erasure, regulators expect clarity. A defined period (e.g., 30 days) is considered best practice to demonstrate compliance and avoid regulatory scrutiny for being overly vague.0