On this page
Published by horak. Attorneys at law / Patent attorneys
Archive · First published 2022-04-08. Editorial revision: 12 November 2026. The original date is retained; the text below distinguishes historical context from present-day application.
The GDPR requires businesses to organise the handling of personal data across people, systems and suppliers. Documentation should support concrete decisions about access, retention, disclosure and responses to individuals.
How to use this archived article
A one-off project does not resolve every future change. New suppliers, products and AI uses may require a renewed assessment, revised contracts or an impact assessment.
Questions for a current matter
Which contractual version and legal regime apply? What happened, when did the parties become aware of it, and which documents preserve the relevant facts? Identify the desired outcome and any procedural deadline before choosing a response.
Four practical examples
Illustrative scenarios, not reports of client mandates. The appropriate response depends on the facts and applicable law.
International support team
A European SaaS provider permits overseas technicians to access customer records. We assess the transfer route and align access controls and contracts.
Employee analytics
An employer wants to score staff performance. We examine necessity, proportionality, transparency and participation rights before rollout.
Access request
A former customer requests copies of all personal data. We identify responsive systems, third-party interests and the lawful scope of the response.
AI training dataset
A company wants to reuse support tickets for model training. We assess purpose compatibility, legal basis, minimisation and whether anonymisation is effective.